Attendo Admin Android Application: Hard-coded MQTT Broker Credentials (CVE-2026-119736)

The Attendo (formerly Petpooja Payroll) Admin Android application, versions 3.0.13 and earlier, contains hard-coded credentials for a production MQTT broker. These credentials are embedded within Flutter configuration assets, specifically in files such as production.json and device-command configuration files. Unauthorized parties can extract these credentials by decompiling the APK file.

Impact

Successful exploitation allows an attacker to authenticate to the production MQTT broker over TCP 1883. Access enables the retrieval of sensitive data from messaging topics, including employee attendance records, personal identifiers, Base64-encoded photographs, and device telemetry. Furthermore, attackers can publish messages to these topics, facilitating unauthorized message injection.

Recommendation

• Inventory all mobile devices within the corporate environment running the Attendo Admin application.
• Upgrade the Attendo Admin Android application to a version released after 3.0.13 once a patch is provided by the vendor.
• Implement network-level monitoring or restrictions on outbound connections to the MQTT broker (TCP 1883) from non-authorized devices.