Attendo Admin Android app exposes hard-coded MQTT broker credentials

Hidden login details in the app let outsiders peek at employee attendance records.

Summary

The Attendo (formerly Petpooja Payroll) Admin Android app version 3.0.13 and earlier contains hard-coded credentials, so anyone who decompiles the APK can get the production MQTT broker login. Attackers can read messages with employee attendance records, personal identifiers, photographs and device data, and inject messages.

Affected when

Attendo Admin Android app 3.0.13 and earlier

What to do

Check that the app is newer than 3.0.13 and read the vendor's advisory. No source names a fixed version.

Products and platforms

Android
Attendo (formerly Petpooja Payroll)

CVE IDs

CVE-2026-119736 (opens in a new tab)

Sources

Write-up: medium.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-02 19:02 UTC

First seen 2026-11-09 14:10 UTC