Attendo (formerly Petpooja Payroll) Admin Android application versions 3.0.13 and earlier contain hard‑coded MQTT broker credentials. An attacker who decompiles the APK can recover these credentials from bundled Flutter configuration assets. With the credentials, the attacker can authenticate to the production MQTT broker over TCP port 1883, read topics that store employee attendance records, personal identifiers, Base64‑encoded photographs, device telemetry, and authentication material, and can publish messages to those topics, exposing sensitive data and enabling unauthorized message injection.

Petpooja:Munshi’s Attendo Admin Android application version 3.0.13 and all earlier releases.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. EPSS is not available, and the vulnerability is not listed in CISA KEV, yet the exploitation path is straightforward. Based on the description, the likely attack vector involves local access to the APK (e.g., via device backup or reverse engineering). Once the credentials are extracted, authentication to the public MQTT broker is trivial, so the risk of data exposure and unauthorized injection is significant.