{"id":"CVE-2026-54375","kind":"vulnerability","aliases":["CVE-2026-54375"],"related":[],"title":"VitaFit Android app: unencrypted session tokens in backups enable account takeover","description":"VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.","summary":"The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 stores session tokens (m_session_id) unencrypted in application backups, and those tokens remain valid for ten years. An attacker who extracts a backup can reuse the token to read or modify the victim's account or delete its login record, locking the owner out.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other","vitafit"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed VitaFit version under the app's info screen or the Android package version for com.vt.vitafit; anything below `2.8.1.0` is in scope","fix":"- VitaFit Android app: move to `2.8.1.0` or later","status":"open","published_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","triaged_at":"2026-11-04T23:09:47+00:00","updated_at":"2026-11-04T23:09:47+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-04T23:09:47Z","model":"claude-haiku-5-5","output":{"fix":"- VitaFit Android app: move to `2.8.1.0` or later\n- unknown","reach":"unknown","title":"VitaFit Android app: unencrypted session tokens in backups enable account takeover","impact":"high","summary":"The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 stores session tokens (m_session_id) unencrypted in application backups, and those tokens remain valid for ten years. An attacker who extracts a backup can reuse the token to read or modify the victim's account or delete its login record, locking the owner out.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","vitafit","mobile"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over the account and can delete its login record","analyst_note":"Confirm how the attacker obtains the backup (local access vs. cloud backup) and whether the fix invalidates existing tokens; check the vulncheck advisory.","how_to_check":"- Check the installed VitaFit version under the app's info screen or the Android package version for com.vt.vitafit; anything below `2.8.1.0` is in scope\n- unknown","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later through the Google Play Store.","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Anyone using the VitaFit Android app before 2.8.1.0 whose app data or backups can be read by an attacker. The sources do not say whether backups must be exfiltrated from the device or whether cloud backups are involved. Users on iOS or on fixed versions are not described as affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4285,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54375':14A,17A '2.8.1.0':28B,78C 'account':10A,64B,121C,125C 'allow':86C 'android':2A,18B,24B,74C 'app':3A,25B 'applic':37B,75C,99C 'attack':48B,87C,107C 'authent':127C 'backup':8A,38B,52B,100C 'com.vt.vitafit':26B,76C 'contain':79C 'cve':12A,15A 'delet':66B,123C 'enabl':9A 'extract':50B,89C 'id':34B,95C 'insecur':81C 'intercept':91C 'legitim':131C 'lock':70B 'log':134C 'login':68B 'm':32B,93C 'manag':83C 'mobil':19B 'modifi':60B,117C 'owner':72B,132C 'prevent':129C 'read':58B,115C 'record':69B,128C 'remain':42B,102C 'reus':54B 'session':5A,30B,33B,82C,94C,112C 'stolen':111C 'store':29B,97C 'takeov':11A 'ten':45B,105C 'token':6A,31B,41B,56B,96C,113C 'unencrypt':4A,35B,92C 'use':109C 'valid':43B,103C 'victim':62B,119C 'vitafit':1A,21B,23B,73C 'vulner':84C 'year':46B,106C","nicknames":[],"mitigations":[],"who_affected":"Anyone using the VitaFit Android app before 2.8.1.0 whose app data or backups can be read by an attacker. The sources do not say whether backups must be exfiltrated from the device or whether cloud backups are involved. Users on iOS or on fixed versions are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later through the Google Play Store.","pkeys":[],"ptokens":[],"labels":["android","high","mobile","other","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T22:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54375","severity":null,"published_at":"2026-11-04T22:18:05+00:00","modified_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","fetched_at":"2026-11-04T23:08:48+00:00","note":null}],"documents":[{"id":71154,"url":"https://www.vulncheck.com/advisories/vitafit-android-long-lived-session-token-exposure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}