---
id: CVE-2026-54384
title: VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
summary: >-
  VitaFit cloud API before 2026-10-30 contained an authentication bypass
  vulnerability that allows remote attackers to obtain a full session for a
  victim's account by submitting a linked Google or Facebook account identifier
  to the POST /f…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-290
vendor: 'Shenzhen Shine Industrial Co., Ltd.'
product: VitaFit
affected:
  - VitaFit < 2026-10-30
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:23:39.111Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54384'
references:
  - url: 'https://github.com/je-lv/vitafit-security-research'
    label: Researcher Disclosure
  - url: 'https://play.google.com/store/apps/details?id=com.vt.vitafit'
    label: Google Play
  - url: >-
      https://www.vulncheck.com/advisories/vitafit-cloud-api-authentication-bypass-via-post-front-login-sns
    label: >-
      VulnCheck Advisory: VitaFit Cloud API Authentication Bypass via POST
      /front/login/sns/
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.642Z'
---

## Overview

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.

## Affected

- `VitaFit < 2026-10-30`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.