CVE-2026-54376

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure custom URI scheme vulnerability. A malicious application can register the same callback scheme (vitafit://vtio.cn ) to intercept Fitbit login tokens. By capturing the 30-day Fitbit authorizatio...