MinorCritical vulnerability
CVE-2026-103906 (CVSS 7.8)
NVD · officialPublished Nov 9, 2026Risk 23/100
Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries.
Technical details
CVSS
7.8
AV:NetworkAC:LowPR:NoneUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source