Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54382— VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access

Quick assessment

Affected
Shenzhen Shine Industrial Co., Ltd. VitaFit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2026 年 10 月 30 日之前，VitaFit 云 API 存在一个访问控制不当的漏洞。该漏洞源于其由 Cognito 颁发的 AWS 角色配置缺陷，使得经过身份验证的攻击者能够对整个共享 S3 存储桶执行 操作，而非被限制在各自的用户文件夹内。攻击者可利用通过 CVE-2026-54378 获取的凭证，在共享 S3 存储桶中覆盖其他用户的对象，从而破坏原始内容，且该操作不会触发任何删除保护机制。

CVSS 7.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54382

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
Source: CVE Program / CVE List V5
Vulnerability Description
VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378, destroying original content without triggering deletion protections.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权授予不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Shenzhen Shine Industrial Co., Ltd. VitaFit 0 ~ 2026-10-30 -

II. Public POCs for CVE-2026-54382

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54382

请登录查看更多情报信息。

Other References for CVE-2026-54382 (3)

Same Patch Batch · Shenzhen Shine Industrial Co., Ltd. · 2026-11-04 · 12 CVEs total

CVE-2026-54384 9.8 CRITICAL VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
CVE-2026-54378 9.6 CRITICAL VitaFit Cloud API Broken Access Control via S3 Token Endpoint
CVE-2026-54372 8.8 HIGH VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
CVE-2026-54375 8.4 HIGH VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
CVE-2026-54376 8.2 HIGH VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
CVE-2026-54374 7.5 HIGH VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
CVE-2026-54381 7.5 HIGH VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
CVE-2026-54383 6.5 MEDIUM VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
CVE-2026-54377 6.5 MEDIUM VitaFit Cloud API IDOR via profile_id Endpoints
CVE-2026-54380 5.4 MEDIUM VitaFit Cloud API Stored XSS via SVG File Upload
CVE-2026-54373 3.5 LOW VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config

IV. Related Vulnerabilities

Same product: VitaFit
Same vendor: Shenzhen Shine Industrial Co., Ltd.
Same weakness: CWE-266