CVE-2026-114221: NewType Infortech｜NT OneAPP - Credential Disclosure
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NewType Infortech NT OneAPPto a version that resolves this vulnerability.Fixed in 1.5.35
Event History
Frequently Asked Questions
Who is exposed to this issue?
Logged-in NT OneAPP users may be exposed if they encounter the specific conditions that cause the app's WebView to present an HTTP Basic Authentication challenge from an unvalidated source. The affected credential is the user's NUP Portal passcode.
What does an attacker need to exploit it?
The attacker can be unauthenticated and remote. Exploitation requires triggering the HTTP Basic Authentication challenge in the WebView under the described specific conditions and relies on user interaction.