CVE-2026-54375 · Other
NO FIX YET · SEE WHAT TO DO
The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 stores session tokens (m_session_id) unencrypted in application backups, and those tokens remain valid for ten years. An attacker who extracts a backup can reuse the token to read or modify the victim's account or delete its login record, locking the owner out.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone using the VitaFit Android app before 2.8.1.0 whose app data or backups can be read by an attacker. The sources do not say whether backups must be exfiltrated from the device or whether cloud backups are involved. Users on iOS or on fixed versions are not described as affected.
Not affected if fixed-version
Who cares android, mobile, vitafit
2.8.1.0 is in scope2.8.1.0 or laterVitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.