NT OneAPP contains a hard‑coded cryptographic key that is embedded in the application. An unauthenticated attacker who can send a remote login request can retrieve this key and use it to decrypt the payload of the request, revealing users’ plaintext account credentials and device data. The flaw is a classic instance of hard‑coded credential misuse (CWE‑798) and allows the attacker to compromise user accounts without any prior authentication.

The vulnerability affects all versions of NewType Infortech’s NT OneAPP released before the patch, namely any build prior to NT OneAPP 1.5.35. Users of these versions are at risk because the application stores the secret key in an accessible form within the codebase.

The CVSS score of 9.1 classifies this as a high‑severity flaw, and the EPSS score is not available; however the absence of an available EPSS does not diminish the demonstrated exploitation path. The vulnerability is listed as not present in the CISA KEV catalog, but its description confirms that it can be abused by remote, unauthenticated attackers from anywhere with network connectivity to the service. Because the attacker requires only the ability to send a login request, the scope of compromise spans confidentiality and integrity for every user of the affected application.