VitaFit (< 2.8.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vitafit--2.8.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 00:07:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374)https://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/Thu, 05 Nov 2026 00:07:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/The VitaFit Android application versions prior to 2.8.1.0 contain hardcoded credentials for WeChat, Tencent QQ, and Fitbit integrations, allowing attackers to extract them via static analysis of the APK.The VitaFit Android application (package com.vt.vitafit) before version 2.8.1.0 contains hardcoded credentials for third-party integrations, specifically WeChat, Tencent QQ, and Fitbit. Attackers can decompile the APK to extract these credentials, leading to unauthorized use of the third-party service accounts.

Impact

Successful exploitation allows for the unauthorized access or misuse of a user's linked WeChat, Tencent QQ, or Fitbit accounts.

Recommendation

  • Update the VitaFit Android application to version 2.8.1.0 or later immediately.
  • Revoke any third-party access tokens or credentials associated with WeChat, Tencent QQ, or Fitbit that were configured within VitaFit prior to the update.
  • Perform a security review of hardcoded configuration data in mobile application builds during the CI/CD pipeline to prevent credential leakage.
]]>highadvisory