VITAFIT CLOUD API · CVE-2026-54384 · Vendor
FIX → 2026-10-30 ✓ verified
The VitaFit cloud API accepts a Google or Facebook account identifier at its social login endpoint without checking proof of ownership, so a remote attacker can get a full session for a victim's account. The attacker can read and change the victim's profile and delete the account's login record, locking the real user out.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
VitaFit smart-scale accounts (Shenzhen Shine Industrial) linked to Google or Facebook login, through the VitaFit cloud API before 2026-10-30. An attacker needed to know the victim's linked social identifier (obtainable via account enumeration), then could read and change the profile and delete the login record. The researcher demonstrated it on a Google-linked test account and says the Android app used the same design for Facebook. VitaFit says the flaw is fixed server-side; people without a VitaFit account can skip it.
Not affected if no-vitafit-account
Who cares account-takeover, cloud-api, smart-scale, social-login, vendor-hosted, vitafit
2.8.1.0 (other CVEs)VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026-10-30
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.