Vitafit
Monthly
VitaFit's cloud API before 2026-10-30 would issue a full authenticated session for any account whose linked Google or Facebook identifier was POSTed to the /front/login/sns/ endpoint, with no proof of ownership from the identity provider. Remote unauthenticated attackers (PR:N, UI:N in the assessed CVSS:3.1 vector) can therefore read and modify the victim's profile and delete the account's authentication record, locking the legitimate user out entirely; the practical prerequisite is knowing or enumerating the victim's linked SNS identifier, which the write-up describes as obtainable through account enumeration. A public PoC reference exists (a GitHub security-research repository); it is not verified as working exploit code, and there is no CISA KEV listing - exploitation is further constrained because the vulnerable component is a vendor-hosted backend that was patched centrally, so only backends not updated on or after 2026-10-30 remain exposed.
The VitaFit cloud API, in builds prior to the 2026-10-30 release, returns other users' personally identifiable and health-profile information to any authenticated account through the GET /front/relation/search/ endpoint. Because search terms are matched loosely, an ordinary signed-in user can walk overlapping alphanumeric queries across the user directory and harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers and Firebase UIDs. A public research reference exists but is not verified as working exploit code; there is no CISA KEV entry and the current priority is monitor, with impact limited to confidentiality (no modification or denial-of-service path).
VitaFit's cloud API left its backing object storage bucket readable by anyone, so an attacker who locates the bucket can enumerate and download stored files - 129,947 objects, of which 126,881 are user-uploaded profile images - with no credentials and no user interaction, exposing personal data tied to app users. The root cause is an incorrect permission assignment (CWE-732) on the storage bucket rather than a code-level memory or injection flaw, and the impact is confined to confidentiality: no write, integrity or availability effect is described, matching the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N against a vendor score of 8.7. Exploitation status: a public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV listing, and the issue is tracked at monitor priority. Anyone running the affected VitaFit cloud API in its pre-2026-10-30 state, and any user whose image was stored in the bucket, should be considered within scope.
Broken access control in the VitaFit cloud API before the 2026-10-30 fix lets any authenticated account holder call POST /front/user/s3/token/ and receive temporary AWS credentials that are not scoped to that user's own storage, so an attacker can enumerate the shared bucket and read or overwrite other users' files. The authentication prerequisite is weak in practice: because the mobile app (com.vt.vitafit) allows normal self-registration, the PR:L requirement in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) is trivially satisfied, and no victim action or special configuration is needed against cloud deployments prior to the fix. Impact is high on both confidentiality and integrity with no availability effect; a public PoC reference exists at the researcher's GitHub repository, but it is not verified as working exploit code, and no CISA KEV listing or active-exploitation confirmation accompanies this CVE.
Token interception in VitaFit Android before 2.8.1.0 allows a malicious app already installed on the device to register the vitafit://vtio.cn callback scheme and capture a 30-day Fitbit OAuth token with weight scope when the victim links a Fitbit account. The stolen token can read, create, and delete the victim's weight and body-fat records through the Fitbit Body API; the attack is local, requires the victim to complete the login flow, and is limited to that Fitbit data. CVSS 4.0 rates it 8.2 High, a public PoC reference exists but is not verified as working exploit code, and the input does not indicate CISA KEV active exploitation.
VitaFit Android before 2.8.1.0 exposes unencrypted m_session_id tokens in application backups, allowing anyone who obtains a backup to read and modify the victim's account or delete the authentication record and lock the owner out. Exploitation is local: the attacker must first obtain backup data containing the token, and no in-app authentication is required once it is captured; the token remains valid for ten years. A public PoC reference exists but is not verified as working exploit code, and there is no KEV confirmation of active exploitation.
Hardcoded third-party integration credentials in the VitaFit Android app before 2.8.1.0 expose embedded WeChat, Tencent QQ, and Fitbit application secrets to anyone who downloads the public APK and decompiles it, with no authentication or user interaction required. The impact is confidentiality-only and is contingent on the exposed credentials still being valid, limiting practical abuse to the associated third-party application registrations. A public PoC reference exists but is not verified as working exploit code, no CISA KEV confirmation of active exploitation is provided, and vuln.today assigns this_week priority.
Insecure TLS certificate validation in the VitaFit Android app (com.vt.vitafit) before 2.8.1.0 lets an unauthenticated attacker sitting on the same or an adjacent network path intercept and modify the app's HTTPS traffic, capturing account sessions and health-related API data; a stolen session can then be used to delete the account's authentication record and lock the legitimate user out. The root cause is baked into the app's default networking - a custom X509TrustManager that trusts every certificate combined with a hostname verifier that accepts any hostname - so no special configuration is needed for an attacker-supplied certificate to be accepted. A public PoC reference exists (a GitHub security-research repository); it is not verified as working exploit code, and no confirmed active exploitation was identified in the available data.
An improper access control flaw in the VitaFit cloud API let authenticated holders of Cognito-issued AWS credentials write objects anywhere in the shared S3 bucket instead of being confined to their own folder, allowing one user's stored content to be overwritten with another's. The affected scope is the VitaFit cloud API before the fix dated 2026-10-30; the weakness is a bucket-wide s3:PutObject grant in the Cognito-mapped IAM role (CWE-266). The input scores the issue 6.3 (CVSS 4.0), exploitation requires a valid authenticated VitaFit identity (PR:L), and the most damaging variant - overwriting a specific victim's objects - depends on credentials said to be obtained through CVE-2026-54378. A public proof-of-concept reference exists (github.com/je-lv/vitafit-security-research) but is not verified as working exploit code, there is no KEV listing, and the priority signal is monitor.
Stored cross-site scripting in the VitaFit cloud API (builds before 2026-10-30) lets an authenticated account holder upload an SVG image containing embedded JavaScript to the shared storage bucket, where it persists and is served to other users as image/svg+xml. The defect is the application's failure to strip scripts from SVG content or force a download via Content-Disposition, so the payload executes only when a victim opens the uploaded file's URL through direct browser navigation rather than inline rendering. Both the CVSS 4.0 vector and the independently assessed CVSS 3.1 vector require low-privileged credentials (PR:L) and victim interaction (UI:P), and server-side confidentiality, integrity and availability impact is none (VC:N/VI:N/VA:N) - the effect is scoped to the victim's browser session (S:C/C:L/I:L). A public PoC reference exists at the je-lv/vitafit-security-research repository; it is not verified as working exploit code, and there is no KEV listing indicating active exploitation. Priority is medium and the vulnerability is triaged as this_month, so remediation is warranted in the normal patch cadence rather than as an emergency.
Authenticated users of the VitaFit fitness and smart-scale cloud API can read other accounts' data - email address, profile details, body-composition reports and daily measurement history - by substituting a different user_id or profile_id in object-referencing endpoints such as GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/. The flaw is an insecure direct object reference (CWE-639) in API builds released before the 2026-10-30 fix; exploitation requires a valid VitaFit account and is only practical at scale because the API also exposes predictable user_id-profile_id relationships and an account-enumeration weakness. Impact is confidentiality-only (no integrity or availability effect), no active exploitation has been confirmed via CISA KEV, and a public proof-of-concept reference exists in a GitHub security-research repository but is not verified as working exploit code.
Cleartext HTTP handling in the VitaFit Android app (com.vt.vitafit) before 2.8.1.0 lets an attacker who holds a man-in-the-middle position on the same untrusted network read and rewrite the traffic the app exchanges with its server, allowing tampering with the support content shown to the user. The app ships no Android network security configuration, so communications that should be encrypted can travel as plain HTTP; confidentiality impact is assessed as none and integrity impact as low, since the abuse is limited to altering displayed support text rather than exposing credentials or executing code. Exploitation requires the victim to be actively using the app on that adjacent network, and a public PoC reference exists (a GitHub security-research repository) though it is not verified as working exploit code; there is no CISA KEV entry and no confirmed active exploitation, and the issue is rated medium severity with low urgency, fixed in version 2.8.1.0.
VitaFit's cloud API before 2026-10-30 would issue a full authenticated session for any account whose linked Google or Facebook identifier was POSTed to the /front/login/sns/ endpoint, with no proof of ownership from the identity provider. Remote unauthenticated attackers (PR:N, UI:N in the assessed CVSS:3.1 vector) can therefore read and modify the victim's profile and delete the account's authentication record, locking the legitimate user out entirely; the practical prerequisite is knowing or enumerating the victim's linked SNS identifier, which the write-up describes as obtainable through account enumeration. A public PoC reference exists (a GitHub security-research repository); it is not verified as working exploit code, and there is no CISA KEV listing - exploitation is further constrained because the vulnerable component is a vendor-hosted backend that was patched centrally, so only backends not updated on or after 2026-10-30 remain exposed.
The VitaFit cloud API, in builds prior to the 2026-10-30 release, returns other users' personally identifiable and health-profile information to any authenticated account through the GET /front/relation/search/ endpoint. Because search terms are matched loosely, an ordinary signed-in user can walk overlapping alphanumeric queries across the user directory and harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers and Firebase UIDs. A public research reference exists but is not verified as working exploit code; there is no CISA KEV entry and the current priority is monitor, with impact limited to confidentiality (no modification or denial-of-service path).
VitaFit's cloud API left its backing object storage bucket readable by anyone, so an attacker who locates the bucket can enumerate and download stored files - 129,947 objects, of which 126,881 are user-uploaded profile images - with no credentials and no user interaction, exposing personal data tied to app users. The root cause is an incorrect permission assignment (CWE-732) on the storage bucket rather than a code-level memory or injection flaw, and the impact is confined to confidentiality: no write, integrity or availability effect is described, matching the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N against a vendor score of 8.7. Exploitation status: a public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV listing, and the issue is tracked at monitor priority. Anyone running the affected VitaFit cloud API in its pre-2026-10-30 state, and any user whose image was stored in the bucket, should be considered within scope.
Broken access control in the VitaFit cloud API before the 2026-10-30 fix lets any authenticated account holder call POST /front/user/s3/token/ and receive temporary AWS credentials that are not scoped to that user's own storage, so an attacker can enumerate the shared bucket and read or overwrite other users' files. The authentication prerequisite is weak in practice: because the mobile app (com.vt.vitafit) allows normal self-registration, the PR:L requirement in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) is trivially satisfied, and no victim action or special configuration is needed against cloud deployments prior to the fix. Impact is high on both confidentiality and integrity with no availability effect; a public PoC reference exists at the researcher's GitHub repository, but it is not verified as working exploit code, and no CISA KEV listing or active-exploitation confirmation accompanies this CVE.
Token interception in VitaFit Android before 2.8.1.0 allows a malicious app already installed on the device to register the vitafit://vtio.cn callback scheme and capture a 30-day Fitbit OAuth token with weight scope when the victim links a Fitbit account. The stolen token can read, create, and delete the victim's weight and body-fat records through the Fitbit Body API; the attack is local, requires the victim to complete the login flow, and is limited to that Fitbit data. CVSS 4.0 rates it 8.2 High, a public PoC reference exists but is not verified as working exploit code, and the input does not indicate CISA KEV active exploitation.
VitaFit Android before 2.8.1.0 exposes unencrypted m_session_id tokens in application backups, allowing anyone who obtains a backup to read and modify the victim's account or delete the authentication record and lock the owner out. Exploitation is local: the attacker must first obtain backup data containing the token, and no in-app authentication is required once it is captured; the token remains valid for ten years. A public PoC reference exists but is not verified as working exploit code, and there is no KEV confirmation of active exploitation.
Hardcoded third-party integration credentials in the VitaFit Android app before 2.8.1.0 expose embedded WeChat, Tencent QQ, and Fitbit application secrets to anyone who downloads the public APK and decompiles it, with no authentication or user interaction required. The impact is confidentiality-only and is contingent on the exposed credentials still being valid, limiting practical abuse to the associated third-party application registrations. A public PoC reference exists but is not verified as working exploit code, no CISA KEV confirmation of active exploitation is provided, and vuln.today assigns this_week priority.
Insecure TLS certificate validation in the VitaFit Android app (com.vt.vitafit) before 2.8.1.0 lets an unauthenticated attacker sitting on the same or an adjacent network path intercept and modify the app's HTTPS traffic, capturing account sessions and health-related API data; a stolen session can then be used to delete the account's authentication record and lock the legitimate user out. The root cause is baked into the app's default networking - a custom X509TrustManager that trusts every certificate combined with a hostname verifier that accepts any hostname - so no special configuration is needed for an attacker-supplied certificate to be accepted. A public PoC reference exists (a GitHub security-research repository); it is not verified as working exploit code, and no confirmed active exploitation was identified in the available data.
An improper access control flaw in the VitaFit cloud API let authenticated holders of Cognito-issued AWS credentials write objects anywhere in the shared S3 bucket instead of being confined to their own folder, allowing one user's stored content to be overwritten with another's. The affected scope is the VitaFit cloud API before the fix dated 2026-10-30; the weakness is a bucket-wide s3:PutObject grant in the Cognito-mapped IAM role (CWE-266). The input scores the issue 6.3 (CVSS 4.0), exploitation requires a valid authenticated VitaFit identity (PR:L), and the most damaging variant - overwriting a specific victim's objects - depends on credentials said to be obtained through CVE-2026-54378. A public proof-of-concept reference exists (github.com/je-lv/vitafit-security-research) but is not verified as working exploit code, there is no KEV listing, and the priority signal is monitor.
Stored cross-site scripting in the VitaFit cloud API (builds before 2026-10-30) lets an authenticated account holder upload an SVG image containing embedded JavaScript to the shared storage bucket, where it persists and is served to other users as image/svg+xml. The defect is the application's failure to strip scripts from SVG content or force a download via Content-Disposition, so the payload executes only when a victim opens the uploaded file's URL through direct browser navigation rather than inline rendering. Both the CVSS 4.0 vector and the independently assessed CVSS 3.1 vector require low-privileged credentials (PR:L) and victim interaction (UI:P), and server-side confidentiality, integrity and availability impact is none (VC:N/VI:N/VA:N) - the effect is scoped to the victim's browser session (S:C/C:L/I:L). A public PoC reference exists at the je-lv/vitafit-security-research repository; it is not verified as working exploit code, and there is no KEV listing indicating active exploitation. Priority is medium and the vulnerability is triaged as this_month, so remediation is warranted in the normal patch cadence rather than as an emergency.
Authenticated users of the VitaFit fitness and smart-scale cloud API can read other accounts' data - email address, profile details, body-composition reports and daily measurement history - by substituting a different user_id or profile_id in object-referencing endpoints such as GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/. The flaw is an insecure direct object reference (CWE-639) in API builds released before the 2026-10-30 fix; exploitation requires a valid VitaFit account and is only practical at scale because the API also exposes predictable user_id-profile_id relationships and an account-enumeration weakness. Impact is confidentiality-only (no integrity or availability effect), no active exploitation has been confirmed via CISA KEV, and a public proof-of-concept reference exists in a GitHub security-research repository but is not verified as working exploit code.
Cleartext HTTP handling in the VitaFit Android app (com.vt.vitafit) before 2.8.1.0 lets an attacker who holds a man-in-the-middle position on the same untrusted network read and rewrite the traffic the app exchanges with its server, allowing tampering with the support content shown to the user. The app ships no Android network security configuration, so communications that should be encrypted can travel as plain HTTP; confidentiality impact is assessed as none and integrity impact as low, since the abuse is limited to altering displayed support text rather than exposing credentials or executing code. Exploitation requires the victim to be actively using the app on that adjacent network, and a public PoC reference exists (a GitHub security-research repository) though it is not verified as working exploit code; there is no CISA KEV entry and no confirmed active exploitation, and the issue is rated medium severity with low urgency, fixed in version 2.8.1.0.