CVE-2026-103906: Disabled TLS Certificate Validation Enables MITM Attacks

Published Nov 9, 2026

Updated

Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries.

Event History

Nov 9, 2026

CVE Published

via MITRE·04:11 PM

Data Sourced

via MITRE·04:11 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs the hard-coded MQTT credentials from the AM CLUB mobile application and the ability to authenticate to the MQTT broker with them.

Who could be affected by exploitation?

Tenants sharing access through the affected MQTT broker could be exposed, because the credentials allow access to data or actions across tenant boundaries.

What could an attacker do after connecting to the broker?

An attacker could access data belonging to other tenants or perform actions across tenant boundaries.

CVE-2026-103906: Disabled TLS Certificate Validation Enables MITM Attacks

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who could be affected by exploitation?

What could an attacker do after connecting to the broker?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who could be affected by exploitation?

What could an attacker do after connecting to the broker?