NewType Infortech｜NT OneAPP - Credential Disclosure
- Published
- Oct 22, 2026
- Last modified
- Oct 22, 2026
- Status
- published
- Known exploitation
- Not listed in CISA KEV
Summary
NT OneAPP allows unauthenticated remote attackers to obtain the NUP Portal passcode of logged-in users by triggering an HTTP Basic Authentication challenge from an unvalidated source within the application's WebView. This credential disclosure vulnerability could allow attackers to gain unauthorized access to user accounts and sensitive information.
Summarized by anthropic/claude-haiku-4.5. Verify details against the original sources.
Read the original description
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
Affected versions
- NewType Infortech NT OneAPP
through 1.5.22