CVE-2026-54372 Details
Description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.
A vulnerability exists in the VitaFit Android application (com.vt.vitafit) in versions prior to 2.8.1.0, allowing for insecure TLS/SSL certificate validation. This flaw enables network-based attackers to intercept and modify HTTPS traffic by taking advantage of a custom X509TrustManager that accepts all certificates and a hostname verifier that allows any hostname. Exploitation of this vulnerability could lead to a man-in-the-middle attack, where attackers capture account sessions and health-related API data. Furthermore, a captured session could be used to delete the account's authentication record, preventing legitimate login.
Users are advised to update the VitaFit Android application to version 2.8.1.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/je-lv/vitafit-security-research | [email protected] | Broken LinkTechnical Analysis |
| https://play.google.com/store/apps/details?id=com.vt.vitafit | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/vitafit-android-insecure-tls-certificate-validation | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VitaFit | < 2.8.1.0 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |