NT OneAPP, developed by NewType Infortech, contains a credential disclosure flaw. Unauthenticated remote users can trigger an HTTP Basic Authentication prompt from an unvalidated source within a WebView under specific conditions, allowing them to acquire the NUP Portal passcode belonging to a logged‑in user. This vulnerability directly compromises the confidentiality of user authentication credentials without requiring prior access authorization.

The affected product is NewType Infortech’s NT OneAPP. Versions prior to 1.5.35 are vulnerable; upgrading to 1.5.35 or later eliminates the issue.

The CVSS score of 5.9 indicates a medium‑severity vulnerability. The EPSS score is not available, so the probability of exploitation remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote; unauthenticated network actors can initiate the exploit via crafted HTTP requests to the WebView component. Given the modest CVSS score and lack of known exploitation data, the risk level is moderate but mitigable with a timely patch.