VitaFit Android CVE-2026-54374

Exploitation requires obtaining the publicly distributed VitaFit APK (com.vt.vitafit) from Google Play for any version before 2.8.1.0 and decompiling it to read the embedded hardcoded WeChat, Tencent QQ, and Fitbit integration secrets - the secrets ship in every copy, so no authentication, non-default configuration, or user interaction is needed. The practical limiting factor is that impact is confined to abuse of those third-party application registrations and is contingent on the exposed credentials still being valid; upgrading to 2.8.1.0 (and the vendor rotating the leaked secrets) removes the exposure.

The input CVSS 4.0 score of 8.7 (High) is driven by AV:N/AC:L/AT:N/PR:N/UI:N with a single confidentiality impact (VC:H) and no integrity or availability impact (VI:N/VA:N) and no scope change to subsequent systems - so the headline severity reflects easy, unauthenticated, network-reachable access rather than a destructive outcome. This is a CWE-798 hardcoded-credentials disclosure: the 'attack' is static analysis of a freely downloadable APK, which CVSS 4.0 rewards heavily because PR:N/UI:N/AV:N all apply, inflating the score relative to the actual harm (exposure of shared third-party integration secrets, not direct user-data compromise). No CISA KEV listing is present in the input and no EPSS probability was provided, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_week', i.e. prompt but not emergency/act_now. A PoC exists only as a reference (a GitHub security-research repo) and is not verified as working exploit code. Signals are therefore broadly consistent - high-ease but confidentiality-only, moderate real-world urgency - with one data conflict: the 'Authentication Bypass' tag contradicts the CWE-798 hardcoded-credentials classification and the description, which describe secret disclosure, not an auth bypass. Real priority is moderate: triage within the week, but this is not an emergency and the downstream risk depends on whether the exposed WeChat/QQ/Fitbit registration secrets remain valid.

An attacker downloads the free VitaFit app (com.vt.vitafit) from Google Play, decompiles the APK with standard tooling, and reads the hardcoded WeChat, Tencent QQ, and Fitbit integration secrets embedded in the code. With those secrets the attacker can abuse the vendor's active third-party application registrations. A public PoC reference exists; it is not verified as working exploit code.