{"id":"CVE-2026-54372","kind":"vulnerability","aliases":["CVE-2026-54372"],"related":[],"title":"VitaFit Android app: certificate checks disabled, health data exposed to interception","description":"VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.","summary":"The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 accepts any TLS certificate and any hostname, so traffic can be intercepted on the network. An attacker on the same network path can capture account sessions and health-related API data, and use a captured session to delete the account's authentication record.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other","vitafit"],"not_affected_if":["app-updated","no-untrusted-networks"],"how_to_check":"- Check the installed VitaFit version (package com.vt.vitafit) and confirm it is `2.8.1.0` or later","fix":"- VitaFit Android application: `2.8.1.0` or later\n- Source does not state a fix beyond the fixed version","status":"open","published_at":"2026-11-04T22:18:04+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","triaged_at":"2026-11-04T23:09:43+00:00","updated_at":"2026-11-04T23:09:43+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T23:09:43Z","model":"claude-haiku-5-5","output":{"fix":"- VitaFit Android application: `2.8.1.0` or later\n- Source does not state a fix beyond the fixed version","reach":"network","title":"VitaFit Android app: certificate checks disabled, health data exposed to interception","impact":"high","summary":"The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 accepts any TLS certificate and any hostname, so traffic can be intercepted on the network. An attacker on the same network path can capture account sessions and health-related API data, and use a captured session to delete the account's authentication record.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","vitafit","mobile"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Account sessions and health data intercepted; account authentication record deleted","analyst_note":"","how_to_check":"- Check the installed VitaFit version (package com.vt.vitafit) and confirm it is `2.8.1.0` or later\n- unknown","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","needs_analyst":false,"not_affected_if":["app-updated","no-untrusted-networks"],"who_is_affected":"Users of the VitaFit Android app before 2.8.1.0 are exposed when they connect over networks an attacker can observe or control, such as public Wi-Fi. The sources do not describe server-side exposure or any default configuration beyond the app's trust handling.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4330,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54372':14A,17A '2.8.1.0':28B,78C 'accept':29B,112C 'account':53B,69B,127C,143C 'allow':87C 'android':2A,18B,24B,74C 'api':59B,133C 'app':3A,25B 'applic':75C 'attack':45B,91C,115C,124C 'authent':71B,145C 'base':90C 'captur':52B,64B,126C,138C 'certif':4A,32B,83C,106C 'check':5A 'com.vt.vitafit':26B,76C 'contain':79C 'custom':101C 'cve':12A,15A 'data':8A,60B,134C 'delet':67B,141C 'disabl':6A 'exploit':99C 'expos':9A 'health':7A,57B,131C 'health-rel':56B,130C 'hostnam':35B,109C,114C 'https':96C 'insecur':81C 'intercept':11A,40B,93C 'legitim':149C 'login':150C 'man':120C 'man-in-the-middl':119C 'middl':123C 'mobil':19B 'modifi':95C 'network':43B,49B,89C 'network-bas':88C 'path':50B 'perform':117C 'prevent':148C 'record':72B,146C 'relat':58B,132C 'session':54B,65B,128C,139C 'tls':31B 'tls/ssl':82C 'traffic':37B,97C 'trust':104C 'use':62B,136C 'valid':84C 'verifi':110C 'vitafit':1A,21B,23B,73C 'vulner':85C 'x509trustmanager':102C","nicknames":[],"mitigations":[],"who_affected":"Users of the VitaFit Android app before 2.8.1.0 are exposed when they connect over networks an attacker can observe or control, such as public Wi-Fi. The sources do not describe server-side exposure or any default configuration beyond the app's trust handling.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","pkeys":[],"ptokens":[],"labels":["android","high","mobile","other","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T22:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54372","severity":null,"published_at":"2026-11-04T22:18:04+00:00","modified_at":"2026-11-04T22:18:04+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","fetched_at":"2026-11-04T23:08:48+00:00","note":null}],"documents":[{"id":71151,"url":"https://www.vulncheck.com/advisories/vitafit-android-insecure-tls-certificate-validation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}