VitaFit Android CVE-2026-54372

Exploitation requires the attacker to occupy an on-path/man-in-the-middle position on the same or an adjacent network as the victim (AV:A) - for example a shared Wi-Fi network or a controlled access point enabling ARP/DNS spoofing - while the victim uses the VitaFit Android app (com.vt.vitafit) at a version before 2.8.1.0. No special app configuration or non-default mode is needed: the insecure behavior is built into the app's default networking, where a custom X509TrustManager trusts all certificates and the hostname verifier accepts any hostname, so any presented certificate is accepted. No authentication and no user interaction are required (PR:N/UI:N). The principal limiting factors are the network-adjacency requirement (not exploitable from the open internet) and the version ceiling - updating to 2.8.1.0 or later removes the flaw.

The CVSS 4.0 base score of 8.7 (High) reflects full compromise of the vulnerable system's confidentiality, integrity and availability (VC:H/VI:H/VA:H), but the attack vector is Adjacent (AV:A), not Network - the attacker must sit on the same or an adjacent network path (e.g. shared Wi-Fi, a malicious access point, or a position allowing ARP/DNS spoofing) rather than attacking across the open internet, which meaningfully narrows the real-world opportunity. Attack complexity is Low and no privileges or user interaction are required (AC:L/PR:N/UI:N), so once the attacker is on-path the flaw is trivially exploitable because the app's custom X509TrustManager trusts all certificates and the hostname verifier accepts any hostname. This is not in CISA KEV and no EPSS score was supplied in the input, so there is no quantitative exploitation-probability or active-exploitation signal to weigh; a public PoC reference exists (a GitHub security-research repository) but it is not verified as working exploit code. The vuln.today decision label is this_week, consistent with a serious-but-not-emergency priority: a genuine high-impact flaw whose exploitation is gated by network adjacency rather than a mass-exploitable internet-facing issue. Net assessment: a real priority for the affected user population, but the Adjacent vector and absence of KEV/EPSS evidence argue for targeted/opportunistic local-network exploitation rather than widespread automated attacks.

An attacker on the same network as a victim (for example a public or semi-trusted Wi-Fi network) positions themselves as a man-in-the-middle and presents a rogue TLS certificate, which the VitaFit app accepts because it trusts all certificates and any hostname. The attacker captures the victim's account session and health-related API data, then replays the captured session to delete the account's authentication record, locking the legitimate user out. A public PoC reference exists (GitHub security-research repo) but it is not verified as working exploit code.