VitaFit - CraftedSignal Threat Feed

VitaFit cloud API: Unauthenticated access via cloud storage misconfiguration (CVE-2026-54381)

hello@craftedsignal.io — Thu, 05 Nov 2026 00:08:13 +0000

VitaFit cloud API versions released prior to 2026-10-30 contained a cloud storage bucket misconfiguration. This vulnerability permitted unauthenticated attackers to perform directory listing and file retrieval operations against the bucket without requiring valid authentication credentials. The misconfiguration exposed 129,947 objects, including 126,881 user-uploaded profile images, potentially leaking sensitive personal information.

Impact

The vulnerability allowed unauthorized access to 129,947 total objects within the misconfigured storage bucket. Verified exposure includes the unauthorized retrieval of 126,881 user-uploaded profile images.

Recommendation

Verify that all cloud storage buckets associated with the VitaFit environment have been audited for public read/list permissions as of 2026-10-30.
Review cloud provider audit logs (e.g., AWS CloudTrail, GCP Cloud Audit Logs, or Azure Monitor) for high volumes of "ListBucket" or "GetObject" API requests originating from unauthorized or anomalous IP addresses to detect potential data exfiltration.

VitaFit Android: Hardcoded third-party integration credentials (CVE-2026-54374)

hello@craftedsignal.io — Thu, 05 Nov 2026 00:07:22 +0000

The VitaFit Android application (package com.vt.vitafit) before version 2.8.1.0 contains hardcoded credentials for third-party integrations, specifically WeChat, Tencent QQ, and Fitbit. Attackers can decompile the APK to extract these credentials, leading to unauthorized use of the third-party service accounts.

Impact

Successful exploitation allows for the unauthorized access or misuse of a user's linked WeChat, Tencent QQ, or Fitbit accounts.

Recommendation

Update the VitaFit Android application to version 2.8.1.0 or later immediately.
Revoke any third-party access tokens or credentials associated with WeChat, Tencent QQ, or Fitbit that were configured within VitaFit prior to the update.
Perform a security review of hardcoded configuration data in mobile application builds during the CI/CD pipeline to prevent credential leakage.

VitaFit Android Application: Insecure SSL/TLS certificate validation (CVE-2026-54372)

hello@craftedsignal.io — Thu, 05 Nov 2026 00:07:15 +0000

The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability. The application uses a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname.

Network-based attackers can perform a man-in-the-middle attack to intercept and modify HTTPS traffic. This allows attackers to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.

VitaFit cloud API: Authentication bypass (CVE-2026-54384)

hello@craftedsignal.io — Thu, 05 Nov 2026 00:05:58 +0000

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability. Remote attackers can obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.