VitaFit Android CVE-2026-54376

Requires a separate malicious Android application already installed on the victim's device that registers the same vitafit://vtio.cn custom URI callback scheme used by VitaFit for its Fitbit OAuth flow. Exploitation only succeeds on VitaFit versions before 2.8.1.0, and the victim must actively perform the Fitbit account-linking/login so the callback carrying the token is generated. Limiting factors: local attack vector (no remote/network path), dependence on pre-installed malicious app, required user interaction to complete the login, and impact scoped to the Fitbit weight/body-fat (weight scope) data only.

CVSS 4.0 rates this 8.2 (High), but the vector tells a nuanced story: AV:L means exploitation is local, not network-reachable, and UI:A requires the victim to actively perform the Fitbit login/OAuth flow. The real precondition is that an attacker-controlled app is already installed on the victim's device and has registered the same vitafit://vtio.cn callback scheme (CWE-926, improper export / scheme hijacking). Impact is meaningful once those conditions are met - the stolen 30-day token grants confidentiality (VC:H, read weight/body-fat) and integrity over the subsequent Fitbit system (SC:H/SI:H, create and delete records) - but the chain of a pre-installed malicious app plus user interaction makes mass, automated exploitation unlikely; this favors targeted abuse over widespread campaigns. No EPSS score was provided and the CVE is not in CISA KEV, so there is no signal of confirmed active exploitation. The vuln.today decision label is 'this_week', indicating prompt remediation rather than emergency. A public PoC reference exists but is not verified as working exploit code, so POC availability should not be read as active exploitation. Net: a legitimate fix-promptly issue scoped to Fitbit weight data, not a drop-everything network RCE.

A user installs a malicious Android app that has registered the vitafit://vtio.cn custom URI scheme used as VitaFit's Fitbit OAuth callback. When the victim later links their Fitbit account inside VitaFit (before 2.8.1.0) and completes the login, the OS can route the callback URL - containing the 30-day weight-scope authorization token - to the attacker's app instead. The attacker then uses the captured token against the Fitbit Body API to read, create, and delete the victim's weight and body-fat records. A GitHub reference PoC exists but is not verified as working exploit code.