CVE-2026-114219: CWE-798 Use of Hard-coded Credentials in NewType Infortech NT OneAPP

CVE-2026-114219 describes a hard-coded credentials vulnerability in NT OneAPP developed by NewType Infortech. The flaw involves a hard-coded cryptographic key embedded in the application, which unauthenticated remote attackers can extract. Using this key, attackers can decrypt login requests, thereby accessing plaintext user credentials and device data. This vulnerability affects all versions from 0 through 1.5.22 inclusive. The CVSS 4.0 vector indicates network attack vector with high complexity and no privileges required, resulting in high confidentiality and integrity impacts.

Exploitation allows unauthenticated remote attackers to obtain the hard-coded cryptographic key and decrypt login request contents. This leads to disclosure of plaintext user account credentials and device information, compromising user privacy and potentially enabling unauthorized access to user accounts and devices.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting network access to the affected application and monitor for suspicious activity related to credential exposure.