CVE-2026-114221High· 7.4▾ TwilightNT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
nt_oneapp <= 1.5.22Update to NT OneAPP version 1.5.35 or later
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114220Critical· 9.1NewType Infortech｜NT OneAPP - Improper Certificate Validation
CVE-2026-114222Medium· 6.2NewType Infortech｜NT OneAPP - Authentication Bypass
CVE-2026-114219High· 7.4NewType Infortech｜NT OneAPP - Hard-coded Credentials
CVE-2026-114223Medium· 5.5NewType Infortech｜NT OneAPP - Exposure of Sensitive Information
CVE-2020-5404Medium· 5.9The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain
CVE-2019-11284High· 8.6Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones