CVE-2026-54376 · Other
NO FIX YET · SEE WHAT TO DO
The VitaFit Android app (com.vt.vitafit, before 2.8.1.0) registers the callback scheme vitafit://vtio.cn, so a malicious app on the same phone can register the same scheme and receive the Fitbit login token in the callback URL. The stolen 30-day token with weight scope lets an attacker read, create and delete the victim's weight and body-fat records through the Fitbit Body API.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users of the VitaFit Android app before 2.8.1.0 who have linked a Fitbit account to it. Exposure depends on a malicious app being installed on the same device that registers the same callback scheme. Users of other platforms or of the fixed version are not affected.
Not affected if fixed-version, ios, no-fitbit-link
Who cares android, fitbit, mobile, vitafit
2.8.1.02.8.1.0 or laterVitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.