CVE-2026-54374 · Other
NO FIX YET · SEE WHAT TO DO
The VitaFit Android app before 2.8.1.0 embeds secret credentials for WeChat, Tencent QQ and Fitbit inside its APK. Anyone who decompiles the app can extract those secrets and abuse the developer's active third-party app registrations.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users of the VitaFit Android app before 2.8.1.0 are exposed, since the secrets ship inside the APK. The risk sits with the app vendor's third-party registrations (WeChat, QQ, Fitbit), which an attacker could abuse; the sources do not say whether user data is directly exposed.
Not affected if version-2.8.1.0-or-later
Who cares android, fitbit, qq, vitafit, wechat
2.8.1.0 or later2.8.1.0 or laterVitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.