EUVD-2026-117149

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...

CVE-2026-54375

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure session management flaw. The application stores unencrypted m_session_id tokens in application backups, which remain valid for ten years. An attacker capable of accessing these backups can inte...