VitaFit Android Application (Com.vt.vitafit) Before 2.8.1.0 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vitafit-android-application-com.vt.vitafit-before-2.8.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 00:07:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372)https://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/Thu, 05 Nov 2026 00:07:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability allowing man-in-the-middle attacks.<p>The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability. The application uses a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname.</p> <p>Network-based attackers can perform a man-in-the-middle attack to intercept and modify HTTPS traffic. This allows attackers to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.</p> highadvisory