---
id: "CVE-2026-54373"
kind: "vulnerability"
aliases: ["CVE-2026-54373"]
title: "VitaFit Android app sends unencrypted HTTP traffic, allowing content tampering"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "mobile", "other", "vitafit"]
not_affected_if: ["app-not-installed", "fixed-version"]
published_at: "2026-11-04T22:18:04+00:00"
first_seen_at: "2026-11-04T23:08:48+00:00"
updated_at: "2026-11-04T23:10:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54373", "first_seen_at": "2026-11-04T23:08:48+00:00"}]
exploit_sources: []
---

# VitaFit Android app sends unencrypted HTTP traffic, allowing content tampering

The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 sends some traffic over cleartext HTTP because it has no Android network security configuration. An attacker on the same untrusted network can read or modify that traffic, including support content shown to the user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed app version for package `com.vt.vitafit`; versions before `2.8.1.0` are affected.
- Review the app's network security configuration for cleartext traffic permissions (unknown if the sources give a specific file or setting).

## Fix

- VitaFit Android app: move to `2.8.1.0` or later (per the NVD range before 2.8.1.0).

## Timeline

- 2026-11-04T23:08:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54373

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-android-cleartext-traffic-via-missing-network-security-config

## From the sources

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_