CVE-2026-54372 · Other
NO FIX YET · SEE WHAT TO DO
The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 accepts any TLS certificate and any hostname, so traffic can be intercepted on the network. An attacker on the same network path can capture account sessions and health-related API data, and use a captured session to delete the account's authentication record.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users of the VitaFit Android app before 2.8.1.0 are exposed when they connect over networks an attacker can observe or control, such as public Wi-Fi. The sources do not describe server-side exposure or any default configuration beyond the app's trust handling.
Not affected if app-updated, no-untrusted-networks
Who cares android, mobile, vitafit
2.8.1.0 or later2.8.1.0 or laterVitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.