EUVD-2026-117152

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme vitafit://vtio.cn. Attackers can capture the 30-day Fitbit authorization toke...

EUVD-2026-117149

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...

EUVD-2026-117148

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the...

EUVD-2026-117146

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that...

EUVD-2026-117147

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can...

CVE-2026-54376

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure custom URI scheme vulnerability. A malicious application can register the same callback scheme (vitafit://vtio.cn ) to intercept Fitbit login tokens. By capturing the 30-day Fitbit authorizatio...

CVE-2026-54375

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure session management flaw. The application stores unencrypted m_session_id tokens in application backups, which remain valid for ten years. An attacker capable of accessing these backups can inte...

CVE-2026-54374

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to a hardcoded credentials disclosure. By decompiling the APK, an attacker can extract confidential third-party integration secrets, specifically for WeChat , Tencent QQ , and Fitbit . These credentials can b...

CVE-2026-54373

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is susceptible to a cleartext traffic vulnerability . The root cause is the absence of an Android network security configuration , which allows network-based attackers to intercept or modify unencrypted HTTP communications...

CVE-2026-54372

The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 is vulnerable to insecure TLS/SSL certificate validation. The root cause is a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. This flaw allows network-based attackers to...