Zero Radar
← feed
CriticalVulnerabilityCVE-2026-114219updated 25 Oct 2026, 16:35 UTC

NT OneAPP login data can be decrypted by anyone due to built-in secret key

NT OneAPP has a secret encryption key written directly into the software. Anyone who finds it can unscramble login requests and read usernames and passwords sent by users.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login needed to start
  2. 2Captures login requestTraffic sent to the app
  3. 3Uses built-in keyKey is hard-coded in software
  4. 4Decrypts requestReads plaintext contents
  5. 5Obtains credentialsAccount passwords and device info exposed
  6. ResultAttacker gains users' account credentials

What happened

NT OneAPP by NewType Infortech contains a hard-coded cryptographic key, which unauthenticated remote attackers can extract and use to decrypt login requests, exposing plaintext account credentials and device information.

Why it is dangerous: Attackers can capture and read users' account credentials and device details without needing any login, so accounts may be taken over.

Are you affected?

You are affected if you run or use NT OneAPP from NewType Infortech.

NT OneAPP by NewType Infortech (versions unknown)

What to do

  1. Check whether NT OneAPP is installed on your systems or used by your organization
  2. Change passwords for any NT OneAPP accounts, and enable any additional account protections available
  3. Restrict network access to NT OneAPP services until the vendor publishes a fix or mitigation
  4. Watch the vendor and the advisory for an update and apply it as soon as it is released

Timeline

  1. 22 Oct 2026, 05:16 UTC
    Publicly disclosed
  2. 22 Oct 2026, 05:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114219 · GHSA-q6g4-8jxr-rp9c
CVSS
9.1 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 05:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

NT OneAPP login data can be decrypted by anyone due to built-in secret key · Zero Radar