VitaFit vulnerabilities
CVEs whose affected-version data names the VitaFit package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
12 CVEsRSS
CVE-2026-54384Critical· 9.8VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /f…
CVE-2026-54383Medium· 6.5VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user …
CVE-2026-54381High· 7.5VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessi…
CVE-2026-54382High· 7.7VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being…
CVE-2026-54378Critical· 9.6VitaFit Cloud API Broken Access Control via S3 Token Endpoint
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improp…
CVE-2026-54380Medium· 5.4VitaFit Cloud API Stored XSS via SVG File Upload
VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the …
CVE-2026-54377Medium· 6.5VitaFit Cloud API IDOR via profile_id Endpoints
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /fr…
CVE-2026-54376High· 8.2VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio…
CVE-2026-54375High· 8.4VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain v…
CVE-2026-54374High· 7.5VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embed…
CVE-2026-54373Low· 3.5VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network se…
CVE-2026-54372High· 8.8VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManag…