VitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374)
The VitaFit Android application versions prior to 2.8.1.0 contain hardcoded credentials for WeChat, Tencent QQ, and Fitbit integrations, allowing attackers to extract them via static analysis of the APK.
CVE search metadata
CVE search record: CVE-2026-54374. Severity: high. CVSS: 7.5. KEV: no. Product: VitaFit (< 2.8.1.0). Brief: VitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374). Brief link: https://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/
CVE search record: CVE-2026-54375. Severity: high. CVSS: 8.4. KEV: no. Product: VitaFit (< 2.8.1.0). Brief: VitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374). Brief link: https://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/
Triage facts
Revision 1- Applicability
- VitaFit (< 2.8.1.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 00:07 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for VitaFit (< 2.8.1.0) Nov 5, 00:07 via nvd
The VitaFit Android application (package com.vt.vitafit) before version 2.8.1.0 contains hardcoded credentials for third-party integrations, specifically WeChat, Tencent QQ, and Fitbit. Attackers can decompile the APK to extract these credentials, leading to unauthorized use of the third-party service accounts.
Impact
Successful exploitation allows for the unauthorized access or misuse of a user's linked WeChat, Tencent QQ, or Fitbit accounts.
Recommendation
- Update the VitaFit Android application to version 2.8.1.0 or later immediately.
- Revoke any third-party access tokens or credentials associated with WeChat, Tencent QQ, or Fitbit that were configured within VitaFit prior to the update.
- Perform a security review of hardcoded configuration data in mobile application builds during the CI/CD pipeline to prevent credential leakage.
Immediate actions
Upgrade VitaFit Android application to version 2.8.1.0 or later.
Threat Hunt
Identify endpoints or mobile devices with vulnerable VitaFit versions installed
Data: Mobile Device Management (MDM) inventory, Application version logs
Mitigations
Upgrade VitaFit to version 2.8.1.0 or later
CVE-2026-54374
Upgrade to version 2.8.1.0
CVE-2026-54375