{"id":"CVE-2026-54384","kind":"vulnerability","aliases":["CVE-2026-54384"],"related":[],"title":"VitaFit cloud API lets attackers log in as any linked user","description":"VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.","summary":"The VitaFit cloud API accepts a Google or Facebook account identifier at its social login endpoint without checking proof of ownership, so a remote attacker can get a full session for a victim's account. The attacker can read and change the victim's profile and delete the account's login record, locking the real user out.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VitaFit cloud API","fixed":["2026-10-30"],"affected":"< 2026-10-30","ecosystem":"vendor"}],"ecosystems":[],"tags":["account-takeover","cloud-api","smart-scale","social-login","vendor","vendor-hosted","vitafit"],"not_affected_if":["no-vitafit-account"],"how_to_check":"VitaFit is a vendor-hosted cloud service, so there is nothing to patch locally. You were exposed only if your VitaFit account was linked to Google or Facebook login before the 2026-10-30 server-side fix. Check your account for unexpected profile changes or unexplained login failures (the flaw let an attacker delete the account's login record). Separate Android-app fixes from the same disclosure are in VitaFit 2.8.1.0 (other CVEs).","fix":"Fixed server-side by VitaFit (cloud API deployed 2026-10-30): the social-login endpoint now accepts only genuine Google/Facebook tokens and rejects invalid ones without creating a session. Researcher verified the fix for Google and Facebook on 2026-11-03.","status":"open","published_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:31:37+00:00","updated_at":"2026-11-05T00:33:28+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-05T00:31:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VitaFit cloud API lets attackers log in as any linked user","impact":"high","summary":"The VitaFit cloud API accepts a Google or Facebook account identifier at its social login endpoint without checking proof of ownership, so a remote attacker can get a full session for a victim's account. The attacker can read and change the victim's profile and delete the account's login record, locking the real user out.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["vitafit","cloud-api","social-login"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes over a victim's account and deletes its login","analyst_note":"Check the VitaFit vendor notice and the VulnCheck advisory for whether the endpoint is fixed and what users should do.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-vitafit-account"],"who_is_affected":"Users of the VitaFit app whose accounts are linked to Google or Facebook login, since the flaw is in VitaFit's cloud service rather than the apps themselves. The sources do not say which accounts or regions are in scope, and do not state a fixed service version. Teams that do not use VitaFit can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000675,"input_tokens":4314,"output_tokens":487,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the VitaFit vendor notice and the VulnCheck advisory for whether the endpoint is fixed and what users should do.","search":"'-10':99C '-2026':13A,16A '-30':100C '-54384':14A,17A '/front/login/sns':132C '2026':98C 'accept':42B 'account':22B,47B,72B,86B,119C,127C,153C,166C 'account-takeov':21B 'allow':107C 'api':3A,20A,26B,41B,96C 'attack':5A,62B,74B,109C,143C 'authent':103C,168C 'bypass':104C 'chang':78B 'check':55B 'cloud':2A,19A,25B,40B,95C 'cloud-api':24B 'contain':101C 'cve':12A,15A 'delet':84B,164C 'endpoint':53B,133C 'enumer':154C 'expos':151C 'facebook':46B,126C 'forg':145C 'full':66B,113C 'get':64B 'googl':44B,124C 'host':36B 'ident':141C 'identifi':48B,128C,150C 'legitim':172C 'let':4A 'link':10A,123C 'lock':90B 'log':6A,175C 'login':32B,52B,88B,147C 'modifi':158C 'obtain':111C 'ownership':58B,138C 'post':131C 'prevent':170C 'profil':82B,162C 'proof':56B,136C 'provid':135C,142C 'read':76B,156C 'real':92B 'record':89B,169C 'remot':61B,108C 'scale':29B 'session':67B,114C 'smart':28B 'smart-scal':27B 'social':31B,51B 'social-login':30B 'submit':121C 'takeov':23B 'use':148C 'user':11A,93B,173C 'vendor':33B,35B 'vendor-host':34B 'victim':70B,80B,117C,160C 'vitafit':1A,18A,37B,39B,94C 'vulner':105C 'without':54B,134C","nicknames":[],"mitigations":[],"who_affected":"VitaFit smart-scale accounts (Shenzhen Shine Industrial) linked to Google or Facebook login, through the VitaFit cloud API before 2026-10-30. An attacker needed to know the victim's linked social identifier (obtainable via account enumeration), then could read and change the profile and delete the login record. The researcher demonstrated it on a Google-linked test account and says the Android app used the same design for Facebook. VitaFit says the flaw is fixed server-side; people without a VitaFit account can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T00:33:28Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/vitafit-cloud-api-authentication-bypass-via-post-front-login-sns","run_id":1734}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Nothing required for this flaw, as VitaFit fixed it on its servers on October 30, 2026; keep the VitaFit app updated in your app store and watch your account for unexpected changes.","pkeys":["cloudapi","vitafitcloudapi"],"ptokens":["api","cloud","vitafit"],"labels":["accounttakeover","cloudapi","critical","smartscale","sociallogin","vendor","vendorhosted","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54384","severity":null,"published_at":"2026-11-04T23:17:48+00:00","modified_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-54384:1734","url":"https://github.com/je-lv/vitafit-security-research","severity":null,"published_at":"2026-11-05T00:33:28+00:00","modified_at":"2026-11-05T00:33:28+00:00","first_seen_at":"2026-11-05T00:33:28+00:00","fetched_at":"2026-11-05T00:33:28+00:00","note":"Researcher (Jose Lomeli) repo says fixed, deployed Oct 30, retested Nov 3. No vendor page found; fix verified from the researcher's disclosure only. Not exploited in the wild, no public PoC code. Did not search X.","cites":["https://github.com/je-lv/vitafit-security-research","https://radar.offseq.com/threat/cve-2026-54384-authentication-bypass-by-spoofing-in-shenzhen-shine-industrial-co-ltd-vitafit-e17658b4fdf18bda"]}],"documents":[{"id":71481,"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-authentication-bypass-via-post-front-login-sns","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":71616,"url":"https://github.com/je-lv/vitafit-security-research","title":"Responsible Disclosure of VitaFit Android and Cloud Security Vulnerabilities (researcher Jose Lomeli)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":71617,"url":"https://radar.offseq.com/threat/cve-2026-54384-authentication-bypass-by-spoofing-in-shenzhen-shine-industrial-co-ltd-vitafit-e17658b4fdf18bda","title":"OffSeq Threat Radar: CVE-2026-54384","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}