---
id: "CVE-2026-54374"
kind: "vulnerability"
aliases: ["CVE-2026-54374"]
title: "VitaFit Android app: hardcoded WeChat, QQ and Fitbit credentials exposed"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "fitbit", "other", "qq", "vitafit", "wechat"]
not_affected_if: ["version-2.8.1.0-or-later"]
published_at: "2026-11-04T22:18:05+00:00"
first_seen_at: "2026-11-04T23:08:48+00:00"
updated_at: "2026-11-04T23:09:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54374", "first_seen_at": "2026-11-04T23:08:48+00:00"}]
exploit_sources: []
---

# VitaFit Android app: hardcoded WeChat, QQ and Fitbit credentials exposed

The VitaFit Android app before 2.8.1.0 embeds secret credentials for WeChat, Tencent QQ and Fitbit inside its APK. Anyone who decompiles the app can extract those secrets and abuse the developer's active third-party app registrations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed VitaFit version (package com.vt.vitafit) on Android and confirm it is `2.8.1.0` or later
- Review whether your organization's accounts or integrations use VitaFit's WeChat, QQ or Fitbit app registrations

## Fix

- VitaFit Android app (com.vt.vitafit): move to `2.8.1.0` or later

## Timeline

- 2026-11-04T23:08:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54374

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-android-hardcoded-credentials-disclosure

## From the sources

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_