---
id: "CVE-2026-54384"
kind: "vulnerability"
aliases: ["CVE-2026-54384"]
title: "VitaFit cloud API lets attackers log in as any linked user"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "VitaFit cloud API", "fixed": ["2026-10-30"], "affected": "< 2026-10-30", "ecosystem": "vendor"}]
ecosystems: []
tags: ["account-takeover", "cloud-api", "smart-scale", "social-login", "vendor", "vendor-hosted", "vitafit"]
not_affected_if: ["no-vitafit-account"]
published_at: "2026-11-04T23:17:48+00:00"
first_seen_at: "2026-11-05T00:31:00+00:00"
updated_at: "2026-11-05T00:33:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54384", "first_seen_at": "2026-11-05T00:31:00+00:00"}, {"source": "analyst", "url": "https://github.com/je-lv/vitafit-security-research", "first_seen_at": "2026-11-05T00:33:28+00:00", "cites": ["https://github.com/je-lv/vitafit-security-research", "https://radar.offseq.com/threat/cve-2026-54384-authentication-bypass-by-spoofing-in-shenzhen-shine-industrial-co-ltd-vitafit-e17658b4fdf18bda"]}]
exploit_sources: []
---

# VitaFit cloud API lets attackers log in as any linked user

The VitaFit cloud API accepts a Google or Facebook account identifier at its social login endpoint without checking proof of ownership, so a remote attacker can get a full session for a victim's account. The attacker can read and change the victim's profile and delete the account's login record, locking the real user out.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VitaFit cloud API affected < 2026-10-30 fixed 2026-10-30

## How to check

VitaFit is a vendor-hosted cloud service, so there is nothing to patch locally. You were exposed only if your VitaFit account was linked to Google or Facebook login before the 2026-10-30 server-side fix. Check your account for unexpected profile changes or unexplained login failures (the flaw let an attacker delete the account's login record). Separate Android-app fixes from the same disclosure are in VitaFit 2.8.1.0 (other CVEs).

## Fix

Fixed server-side by VitaFit (cloud API deployed 2026-10-30): the social-login endpoint now accepts only genuine Google/Facebook tokens and rejects invalid ones without creating a session. Researcher verified the fix for Google and Facebook on 2026-11-03.

## Timeline

- 2026-11-05T00:31:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54384
- 2026-11-05T00:33:28+00:00 analyst https://github.com/je-lv/vitafit-security-research — Researcher (Jose Lomeli) repo says fixed, deployed Oct 30, retested Nov 3. No vendor page found; fix verified from the researcher's disclosure only. Not exploited in the wild, no public PoC code. Did not search X.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-cloud-api-authentication-bypass-via-post-front-login-sns
- [fix] Responsible Disclosure of VitaFit Android and Cloud Security Vulnerabilities (researcher Jose Lomeli) https://github.com/je-lv/vitafit-security-research
- [mentions] OffSeq Threat Radar: CVE-2026-54384 https://radar.offseq.com/threat/cve-2026-54384-authentication-bypass-by-spoofing-in-shenzhen-shine-industrial-co-ltd-vitafit-e17658b4fdf18bda

## From the sources

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_