{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/vitafit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vitafit:cloud_api:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-54381"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VitaFit cloud API (\u003c 2026-10-30)"],"_cs_severities":["high"],"_cs_tags":["cloud","misconfiguration","data-exposure","cve-2026-54381"],"_cs_type":"advisory","_cs_vendors":["VitaFit"],"content_html":"\u003cp\u003eVitaFit cloud API versions released prior to 2026-10-30 contained a cloud storage bucket misconfiguration. This vulnerability permitted unauthenticated attackers to perform directory listing and file retrieval operations against the bucket without requiring valid authentication credentials. The misconfiguration exposed 129,947 objects, including 126,881 user-uploaded profile images, potentially leaking sensitive personal information.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allowed unauthorized access to 129,947 total objects within the misconfigured storage bucket. Verified exposure includes the unauthorized retrieval of 126,881 user-uploaded profile images.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eVerify that all cloud storage buckets associated with the VitaFit environment have been audited for public read/list permissions as of 2026-10-30.\u003c/li\u003e\n\u003cli\u003eReview cloud provider audit logs (e.g., AWS CloudTrail, GCP Cloud Audit Logs, or Azure Monitor) for high volumes of \u0026quot;ListBucket\u0026quot; or \u0026quot;GetObject\u0026quot; API requests originating from unauthorized or anomalous IP addresses to detect potential data exfiltration.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T00:08:13Z","date_published":"2026-11-05T00:08:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-cloud-storage-misconfiguration/","summary":"A misconfigured cloud storage bucket in the VitaFit cloud API allowed unauthenticated attackers to list and download sensitive user data, including over 126,000 profile images.","title":"VitaFit cloud API: Unauthenticated access via cloud storage misconfiguration (CVE-2026-54381)","url":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-cloud-storage-misconfiguration/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vitafit:vitafit:*:*:*:*:*:android:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-54374"},{"cvss":8.4,"id":"CVE-2026-54375"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VitaFit (\u003c 2.8.1.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["VitaFit"],"content_html":"\u003cp\u003eThe VitaFit Android application (package com.vt.vitafit) before version 2.8.1.0 contains hardcoded credentials for third-party integrations, specifically WeChat, Tencent QQ, and Fitbit. Attackers can decompile the APK to extract these credentials, leading to unauthorized use of the third-party service accounts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized access or misuse of a user's linked WeChat, Tencent QQ, or Fitbit accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the VitaFit Android application to version 2.8.1.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eRevoke any third-party access tokens or credentials associated with WeChat, Tencent QQ, or Fitbit that were configured within VitaFit prior to the update.\u003c/li\u003e\n\u003cli\u003ePerform a security review of hardcoded configuration data in mobile application builds during the CI/CD pipeline to prevent credential leakage.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T00:07:30Z","date_published":"2026-11-05T00:07:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/","summary":"The VitaFit Android application versions prior to 2.8.1.0 contain hardcoded credentials for WeChat, Tencent QQ, and Fitbit integrations, allowing attackers to extract them via static analysis of the APK.","title":"VitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374)","url":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-hardcoded-creds/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vitafit:vitafit:*:*:*:*:*:android:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-54372"},{"cvss":8.2,"id":"CVE-2026-54376"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VitaFit Android application (com.vt.vitafit) before 2.8.1.0","VitaFit Android application (\u003c 2.8.1.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["VitaFit"],"content_html":"\u003cp\u003eThe VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability. The application uses a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname.\u003c/p\u003e\n\u003cp\u003eNetwork-based attackers can perform a man-in-the-middle attack to intercept and modify HTTPS traffic. This allows attackers to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.\u003c/p\u003e\n","date_modified":"2026-11-05T00:07:36Z","date_published":"2026-11-05T00:07:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/","summary":"The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability allowing man-in-the-middle attacks.","title":"VitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372)","url":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-tls-vuln/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-54384"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-54384\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["VitaFit"],"content_html":"\u003cp\u003eVitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability. Remote attackers can obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.\u003c/p\u003e\n","date_modified":"2026-11-05T00:20:58Z","date_published":"2026-11-05T00:05:58Z","id":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-auth-bypass/","summary":"VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability allowing remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership.","title":"VitaFit cloud API: Authentication bypass (CVE-2026-54384)","url":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - VitaFit","version":"https://jsonfeed.org/version/1.1"}