{"id":"CVE-2026-54376","kind":"vulnerability","aliases":["CVE-2026-54376"],"related":[],"title":"VitaFit Android app: custom URI scheme lets another app steal Fitbit tokens","description":"VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.","summary":"The VitaFit Android app (com.vt.vitafit, before 2.8.1.0) registers the callback scheme vitafit://vtio.cn, so a malicious app on the same phone can register the same scheme and receive the Fitbit login token in the callback URL. The stolen 30-day token with weight scope lets an attacker read, create and delete the victim's weight and body-fat records through the Fitbit Body API.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","fitbit","mobile","other","vitafit"],"not_affected_if":["fixed-version","ios","no-fitbit-link"],"how_to_check":"- Check the installed VitaFit app version in the Android app settings or Play Store; affected if below `2.8.1.0`\n- Check whether the Fitbit account is linked to VitaFit (Fitbit app > Apps > VitaFit)","fix":"- VitaFit Android app: move to `2.8.1.0` or later","status":"open","published_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","triaged_at":"2026-11-04T23:09:48+00:00","updated_at":"2026-11-04T23:09:48+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T23:09:48Z","model":"claude-haiku-5-5","output":{"fix":"- VitaFit Android app: move to `2.8.1.0` or later","reach":"local","title":"VitaFit Android app: custom URI scheme lets another app steal Fitbit tokens","impact":"medium","summary":"The VitaFit Android app (com.vt.vitafit, before 2.8.1.0) registers the callback scheme vitafit://vtio.cn, so a malicious app on the same phone can register the same scheme and receive the Fitbit login token in the callback URL. The stolen 30-day token with weight scope lets an attacker read, create and delete the victim's weight and body-fat records through the Fitbit Body API.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","fitbit","vitafit","mobile"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads, creates and deletes Fitbit weight and body-fat records","analyst_note":"","how_to_check":"- Check the installed VitaFit app version in the Android app settings or Play Store; affected if below `2.8.1.0`\n- Check whether the Fitbit account is linked to VitaFit (Fitbit app > Apps > VitaFit)","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","needs_analyst":false,"not_affected_if":["fixed-version","no-fitbit-link","ios"],"who_is_affected":"Users of the VitaFit Android app before 2.8.1.0 who have linked a Fitbit account to it. Exposure depends on a malicious app being installed on the same device that registers the same callback scheme. Users of other platforms or of the fixed version are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000742,"input_tokens":4313,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-54376':15A,18A '2.8.1.0':30B,93C '30':61B,122C 'allow':102C 'android':2A,19B,26B,89C 'anoth':8A 'api':87B,153C 'app':3A,9A,27B,39B 'applic':90C,105C 'attack':69B,118C 'author':125C 'bodi':80B,86B,146C,152C 'body-fat':79B,145C 'callback':33B,57B,115C,133C 'captur':120C 'com.vt.vitafit':28B,91C 'contain':94C 'creat':71B,137C 'custom':4A,97C 'cve':13A,16A 'day':62B,123C 'delet':73B,139C 'deliv':130C 'fat':81B,147C 'fitbit':11A,20B,52B,85B,108C,124C,151C 'insecur':96C 'intercept':107C 'let':7A,67B 'login':53B,109C 'malici':38B,104C 'mobil':21B 'phone':43B 'read':70B,136C 'receiv':50B 'record':82B,148C 'regist':31B,45B,112C 'scheme':6A,34B,48B,99C,116C 'scope':66B,129C 'steal':10A 'stolen':60B 'token':12A,54B,63B,110C,126C 'uri':5A,98C 'url':58B,134C 'via':149C 'victim':75B,141C 'vitafit':1A,23B,25B,88C 'vtio.cn':35B,117C 'vulner':100C 'weight':65B,77B,128C,143C","nicknames":[],"mitigations":[],"who_affected":"Users of the VitaFit Android app before 2.8.1.0 who have linked a Fitbit account to it. Exposure depends on a malicious app being installed on the same device that registers the same callback scheme. Users of other platforms or of the fixed version are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","pkeys":[],"ptokens":[],"labels":["android","fitbit","high","mobile","other","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T22:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54376","severity":null,"published_at":"2026-11-04T22:18:05+00:00","modified_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","fetched_at":"2026-11-04T23:08:48+00:00","note":null}],"documents":[{"id":71155,"url":"https://www.vulncheck.com/advisories/vitafit-android-custom-uri-scheme-token-hijacking","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}