Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-54376 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:8.2 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/je-lv/vitafit-security-research	[email protected]	BundleTechnical Analysis
https://play.google.com/store/apps/details?id=com.vt.vitafit	[email protected]	ProductVendor
https://www.vulncheck.com/advisories/vitafit-android-custom-uri-scheme-token-hijacking	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-926	Improper Export of Android Application Components	[email protected]

Affected Products

Product	Versions
VitaFit	< 2.8.1.0
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 2.8.1.0moderate effort

Change History

1 change record found show changes