{"id":"CVE-2026-54374","kind":"vulnerability","aliases":["CVE-2026-54374"],"related":[],"title":"VitaFit Android app: hardcoded WeChat, QQ and Fitbit credentials exposed","description":"VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.","summary":"The VitaFit Android app before 2.8.1.0 embeds secret credentials for WeChat, Tencent QQ and Fitbit inside its APK. Anyone who decompiles the app can extract those secrets and abuse the developer's active third-party app registrations.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","fitbit","other","qq","vitafit","wechat"],"not_affected_if":["version-2.8.1.0-or-later"],"how_to_check":"- Check the installed VitaFit version (package com.vt.vitafit) on Android and confirm it is `2.8.1.0` or later\n- Review whether your organization's accounts or integrations use VitaFit's WeChat, QQ or Fitbit app registrations","fix":"- VitaFit Android app (com.vt.vitafit): move to `2.8.1.0` or later","status":"open","published_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","triaged_at":"2026-11-04T23:09:44+00:00","updated_at":"2026-11-04T23:09:44+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T23:09:44Z","model":"claude-haiku-5-5","output":{"fix":"- VitaFit Android app (com.vt.vitafit): move to `2.8.1.0` or later","reach":"internet","title":"VitaFit Android app: hardcoded WeChat, QQ and Fitbit credentials exposed","impact":"medium","summary":"The VitaFit Android app before 2.8.1.0 embeds secret credentials for WeChat, Tencent QQ and Fitbit inside its APK. Anyone who decompiles the app can extract those secrets and abuse the developer's active third-party app registrations.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","vitafit","fitbit","wechat","qq"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers abuse embedded third-party integration secrets for WeChat, QQ and Fitbit","analyst_note":"","how_to_check":"- Check the installed VitaFit version (package com.vt.vitafit) on Android and confirm it is `2.8.1.0` or later\n- Review whether your organization's accounts or integrations use VitaFit's WeChat, QQ or Fitbit app registrations","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","needs_analyst":false,"not_affected_if":["version-2.8.1.0-or-later"],"who_is_affected":"Users of the VitaFit Android app before 2.8.1.0 are exposed, since the secrets ship inside the APK. The risk sits with the app vendor's third-party registrations (WeChat, QQ, Fitbit), which an attacker could abuse; the sources do not say whether user data is directly exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4284,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54374':13A,16A '2.8.1.0':28B,66C 'abus':51B,102C 'activ':55B,104C 'allow':73C 'android':2A,17B,25B,62C 'anyon':41B 'apk':40B,86C 'app':3A,26B,45B,59B 'applic':63C,100C,108C 'attack':74C,87C 'com.vt.vitafit':64C 'confidenti':77C 'contain':67C 'credenti':9A,31B,70C,96C 'cve':11A,14A 'decompil':43B,84C,99C 'develop':53B 'emb':29B 'embed':90C 'expos':10A 'extract':47B,76C 'fitbit':8A,18B,37B,95C 'hardcod':4A,69C 'insid':38B 'integr':81C 'parti':58B,80C,107C 'qq':6A,20B,35B,93C 'registr':60B,109C 'retriev':89C 'secret':30B,49B,82C 'tencent':34B,92C 'third':57B,79C,106C 'third-parti':56B,78C,105C 'vitafit':1A,21B,24B,61C 'vulner':71C 'wechat':5A,22B,33B,91C","nicknames":[],"mitigations":[],"who_affected":"Users of the VitaFit Android app before 2.8.1.0 are exposed, since the secrets ship inside the APK. The risk sits with the app vendor's third-party registrations (WeChat, QQ, Fitbit), which an attacker could abuse; the sources do not say whether user data is directly exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","pkeys":[],"ptokens":[],"labels":["android","fitbit","high","other","qq","vitafit","wechat"],"campaign_type":null,"first_public_at":"2026-11-04T22:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54374","severity":null,"published_at":"2026-11-04T22:18:05+00:00","modified_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","fetched_at":"2026-11-04T23:08:48+00:00","note":null}],"documents":[{"id":71153,"url":"https://www.vulncheck.com/advisories/vitafit-android-hardcoded-credentials-disclosure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}