„Für uns ist das ein Schock.“ Auch Zusammenführung von Switch- und HVV‑App stockt. Was Insider über Rolle des freigestellten Hochbahn-Chefs sagen.

The NT OneAPP program from NewType Infortech includes a fixed secret key that anyone on the internet can retrieve.

The NT OneAPP application does not properly check the server’s security certificate, so an attacker on the same network could pretend to be the legitimate.

CVE-2026-114219 describes a hard-coded credentials vulnerability in NT OneAPP developed by NewType Infortech. The flaw involves a hard-coded cryptographic key embedded in the application, which unauthenticated remote attackers can extract.

CVE-2026-114220 describes an improper certificate validation vulnerability in NewType Infortech's NT OneAPP. The application fails to properly validate the server certificate and hostname during TLS communications, enabling unauthenticated

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user.

NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.

NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.

Image source: TechCabal On April 2, Safaricom, Kenya’s largest telco, unveiled its My OneApp, a platform meant to merge the M-PESA and mySafaricom apps with overlapping features.  As part of its FinTech 2.0 strategy, Safaricom wants to keep customers locked in one app where they can do everything from buying airtime, sending and receiving money, investing, and accessing loans. It will enable the company to track user behaviour in a single view.

Safaricom’s newly launched My OneApp is facing widespread login failures just days after its debut, complicating plans to phase out its legacy M-PESA and mySafaricom platforms within six months. The Nairobi-listed company first confirmed the issue to a customer on April 4. “We are aware My OneApp has login issues, and most of the financial mini-app services are not working,” Safaricom said in a response on X.