CVE-2026-54373 · Other
NO FIX YET · SEE WHAT TO DO
The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 sends some traffic over cleartext HTTP because it has no Android network security configuration. An attacker on the same untrusted network can read or modify that traffic, including support content shown to the user.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users of the VitaFit Android app older than 2.8.1.0 are exposed, mainly when on untrusted networks such as public Wi-Fi. The flaw is in the app's traffic handling, so the attacker needs to be on the network path between the app and its server. Users on the fixed version or who do not use the app can skip it.
Not affected if app-not-installed, fixed-version
Who cares android, mobile, vitafit
com.vt.vitafit; versions before 2.8.1.0 are affected.2.8.1.0 or later (per the NVD range before 2.8.1.0).VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.