Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54372— VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation

Quick assessment

Affected
Shenzhen Shine Industrial Co., Ltd. VitaFit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VitaFit Android 应用程序（com.vt.vitafit）在版本 2.8.1.0 之前存在不安全的 TLS/SSL 证书验证漏洞。该漏洞源于其自定义的 X509TrustManager 信任所有证书，以及主机名验证器接受任意主机名，使得基于网络的攻击者能够拦截并篡改 HTTPS 流量。攻击者可利用此漏洞实施中间人攻击，窃取用户账户会话及与健康相关的 API 数据；随后利用截获的会话删除账户的认证记录，从而阻止合法用户登录。

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54372

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
Source: CVE Program / CVE List V5
Vulnerability Description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Shenzhen Shine Industrial Co., Ltd. VitaFit 0 ~ 2.8.1.0 -

II. Public POCs for CVE-2026-54372

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54372

请登录查看更多情报信息。

Other References for CVE-2026-54372 (3)

Same Patch Batch · Shenzhen Shine Industrial Co., Ltd. · 2026-11-04 · 12 CVEs total

CVE-2026-54384 9.8 CRITICAL VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
CVE-2026-54378 9.6 CRITICAL VitaFit Cloud API Broken Access Control via S3 Token Endpoint
CVE-2026-54375 8.4 HIGH VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
CVE-2026-54376 8.2 HIGH VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
CVE-2026-54382 7.7 HIGH VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
CVE-2026-54374 7.5 HIGH VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
CVE-2026-54381 7.5 HIGH VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
CVE-2026-54383 6.5 MEDIUM VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
CVE-2026-54377 6.5 MEDIUM VitaFit Cloud API IDOR via profile_id Endpoints
CVE-2026-54380 5.4 MEDIUM VitaFit Cloud API Stored XSS via SVG File Upload
CVE-2026-54373 3.5 LOW VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config

IV. Related Vulnerabilities

Same product: VitaFit
Same vendor: Shenzhen Shine Industrial Co., Ltd.
Same weakness: CWE-295