EUVD-2026-117160

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881...

EUVD-2026-117163

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite oth...

EUVD-2026-117165

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using...

EUVD-2026-117167

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

EUVD-2026-117157

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...

EUVD-2026-117152

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme vitafit://vtio.cn. Attackers can capture the 30-day Fitbit authorization toke...

EUVD-2026-117149

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...

EUVD-2026-117154

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different userid or profileid to endpoints such as GET /front/profile/profileid/report/ and GET...

EUVD-2026-117155

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

EUVD-2026-117146

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that...

EUVD-2026-117148

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the...

EUVD-2026-117147

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can...

CVE-2026-54384

The VitaFit cloud API (prior to 2026-10-30) is vulnerable to an authentication bypass in the POST /front/login/sns/ endpoint. This flaw allows remote attackers to gain a full session for a victim's account by submitting a linked Google or Facebook account identifier without providing proof of own...

CVE-2026-54383

The VitaFit cloud API (versions before 2026-10-30) contains an excessive data exposure vulnerability via the GET /front/relation/search/ endpoint. This flaw allows any authenticated user to perform directory enumeration by using overlapping alphanumeric search terms. Successful exploitation resul...

CVE-2026-54382

The VitaFit cloud API contained an improper access control vulnerability in its Cognito-issued AWS role prior to 2026-10-30. This misconfiguration allows authenticated attackers to perform s3:PutObject operations across a shared S3 bucket, bypassing restrictions that should limit access to indivi...

CVE-2026-54381

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to an unauthenticated information disclosure due to a misconfigured cloud storage bucket . This flaw allows attackers to list and download files without any credentials, potentially exposing sensitive personal data. Specifically,...

CVE-2026-54380

The VitaFit cloud API (versions prior to 2026-10-30) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the application's failure to restrict scripts or enforce downloads for image/svg+xml content. This allows authenticated attackers to upload an SVG image conta...

CVE-2026-54378

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to a broken access control flaw. By calling the POST /front/user/s3/token/ endpoint, any authenticated user can obtain temporary AWS credentials that are improperly scoped. This allows an attacker to list the shared storage bucke...

CVE-2026-54377

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access another user's private data by supplying different user_id or profile_id values to endpoints such as GET /front/profile/{profile_id}/...

CVE-2026-54376

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure custom URI scheme vulnerability. A malicious application can register the same callback scheme (vitafit://vtio.cn ) to intercept Fitbit login tokens. By capturing the 30-day Fitbit authorizatio...