CVE-2026-54375 Details
Description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.
A vulnerability in the VitaFit Android application, specifically in versions prior to 2.8.1.0, has been identified. This vulnerability involves insecure session management that allows attackers to extract or intercept unencrypted 'm_session_id' tokens stored in application backups. These tokens remain valid for ten years. Exploitation of this vulnerability enables attackers to read and modify the victim's account or delete the account's authentication record, thereby preventing the legitimate owner from logging in again.
VitaFit has updated the application to version 2.8.1.0, which encrypts stored session tokens and ensures that logout and password reset actions invalidate active sessions. However, it's important to note that old session tokens issued before this update are still temporarily accepted by the server. VitaFit plans to completely reject these old tokens after January 28, 2027.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/je-lv/vitafit-security-research | [email protected] | BundleTechnical Analysis |
| https://play.google.com/store/apps/details?id=com.vt.vitafit | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/vitafit-android-long-lived-session-token-exposure | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VitaFit | < 2.8.1.0 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |