---
id: "CVE-2026-54372"
kind: "vulnerability"
aliases: ["CVE-2026-54372"]
title: "VitaFit Android app: certificate checks disabled, health data exposed to interception"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "mobile", "other", "vitafit"]
not_affected_if: ["app-updated", "no-untrusted-networks"]
published_at: "2026-11-04T22:18:04+00:00"
first_seen_at: "2026-11-04T23:08:48+00:00"
updated_at: "2026-11-04T23:09:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54372", "first_seen_at": "2026-11-04T23:08:48+00:00"}]
exploit_sources: []
---

# VitaFit Android app: certificate checks disabled, health data exposed to interception

The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 accepts any TLS certificate and any hostname, so traffic can be intercepted on the network. An attacker on the same network path can capture account sessions and health-related API data, and use a captured session to delete the account's authentication record.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed VitaFit version (package com.vt.vitafit) and confirm it is `2.8.1.0` or later

## Fix

- VitaFit Android application: `2.8.1.0` or later
- Source does not state a fix beyond the fixed version

## Timeline

- 2026-11-04T23:08:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54372

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-android-insecure-tls-certificate-validation

## From the sources

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_