VitaFit Android EUVD-2026-117149

Exploitation requires the attacker to obtain the application's backup data (e.g., an Android/adb backup, an exported or cloud-synced backup, or device-level access) that contains the unencrypted m_session_id session token, for VitaFit Android versions before 2.8.1.0. Because the token remains valid for ten years, there is no session-expiry limit to prevent reuse once it is captured. The principal limiting factor is the LOCAL attack vector (CVSS AV:L): the flaw is not remotely exploitable over the network against a default configuration - the attacker must first gain access to the backup artifact. No in-app authentication or privileges are needed to use a stolen token (PR:N), and no user interaction is required.

Signals are mixed and point to a serious-but-not-remote-mass-exploitation issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 8.6 High) is the decisive signal: the attack vector is LOCAL, meaning an attacker must first obtain the victim's application backup data to read the unencrypted m_session_id token - this is not a network-exploitable flaw against a listening service, so the 'High' rating reflects full account compromise once access is achieved, not easy remote reach. The vuln.today priority is 'this_week' (not act_now/emergency). There is NO CISA KEV listing (no confirmed active exploitation) and NO EPSS score was provided, so widespread opportunistic exploitation cannot be quantified from the input. A public PoC reference exists (VulnCheck/GitHub security research) but it is not verified as working exploit code, so POC availability should not be read as a weaponized exploit. The genuinely aggravating factor is the ten-year token lifetime (CWE-613): a single stolen token grants durable, long-lived account takeover with no expiry to limit reuse. Net: a real priority for affected users, warranting prompt patching, but its practical risk is gated by the need for local access to backup data rather than being a drive-by remote threat.

An attacker who obtains a victim's Android backup (for example via adb backup, an exported/cloud backup, or direct device access) extracts the unencrypted m_session_id token and, because the token stays valid for ten years, replays it to fully control the victim's VitaFit account - reading and modifying data or deleting the authentication record to lock the owner out permanently. A public PoC reference exists but is not verified as working exploit code. The CVSS local attack vector (AV:L, AC:L) means the attacker needs access to the backup data rather than a purely remote network path.