VitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372)
The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability allowing man-in-the-middle attacks.
CVE search metadata
CVE search record: CVE-2026-54372. Severity: high. CVSS: 8.8. KEV: no. Product: VitaFit Android application (com.vt.vitafit) before 2.8.1.0, VitaFit Android application (< 2.8.1.0). Brief: VitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372). Brief link: https://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/
CVE search record: CVE-2026-54376. Severity: high. CVSS: 8.2. KEV: no. Product: VitaFit Android application (com.vt.vitafit) before 2.8.1.0, VitaFit Android application (< 2.8.1.0). Brief: VitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372). Brief link: https://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/
Triage facts
Revision 1- Applicability
- VitaFit Android application (com.vt.vitafit) before 2.8.1.0, VitaFit Android application (< 2.8.1.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 00:07 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
What's new
- 1. added coverage for VitaFit Android application (< 2.8.1.0) Nov 5, 00:07 via nvd
The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability. The application uses a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname.
Network-based attackers can perform a man-in-the-middle attack to intercept and modify HTTPS traffic. This allows attackers to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.
Immediate actions
Verify version of VitaFit application across mobile device management (MDM) inventory
Threat Hunt
Identify applications installed on enterprise-managed devices that register the vitafit:// custom URI scheme
Data: MDM/UEM inventory of installed packages and registered URI handlers
Mitigations
Upgrade to VitaFit version 2.8.1.0 or later
CVE-2026-54376