Cpe:2.3:a:vitafit:vitafit:*:*:*:*:*:android:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3avitafitvitafitandroid/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 00:07:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374)https://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/Thu, 05 Nov 2026 00:07:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/The VitaFit Android application versions prior to 2.8.1.0 contain hardcoded credentials for WeChat, Tencent QQ, and Fitbit integrations, allowing attackers to extract them via static analysis of the APK.The VitaFit Android application (package com.vt.vitafit) before version 2.8.1.0 contains hardcoded credentials for third-party integrations, specifically WeChat, Tencent QQ, and Fitbit. Attackers can decompile the APK to extract these credentials, leading to unauthorized use of the third-party service accounts.

Impact

Successful exploitation allows for the unauthorized access or misuse of a user's linked WeChat, Tencent QQ, or Fitbit accounts.

Recommendation

  • Update the VitaFit Android application to version 2.8.1.0 or later immediately.
  • Revoke any third-party access tokens or credentials associated with WeChat, Tencent QQ, or Fitbit that were configured within VitaFit prior to the update.
  • Perform a security review of hardcoded configuration data in mobile application builds during the CI/CD pipeline to prevent credential leakage.
]]>highadvisoryVitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372)https://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/Thu, 05 Nov 2026 00:07:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability allowing man-in-the-middle attacks.<p>The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability. The application uses a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname.</p> <p>Network-based attackers can perform a man-in-the-middle attack to intercept and modify HTTPS traffic. This allows attackers to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.</p> highadvisory