Vendor
VitaFit cloud API: Unauthenticated access via cloud storage misconfiguration (CVE-2026-54381)
1 TTP 1 CVEA misconfigured cloud storage bucket in the VitaFit cloud API allowed unauthenticated attackers to list and download sensitive user data, including over 126,000 profile images.
VitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374)
2 TTPs 2 CVEsThe VitaFit Android application versions prior to 2.8.1.0 contain hardcoded credentials for WeChat, Tencent QQ, and Fitbit integrations, allowing attackers to extract them via static analysis of the APK.
VitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372)
1 TTP 2 CVEsThe VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability allowing man-in-the-middle attacks.
VitaFit cloud API: Authentication bypass (CVE-2026-54384)
1 CVEVitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability allowing remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership.