CVE-2026-54384 Details
Description
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.
An authentication bypass vulnerability has been identified in the VitaFit cloud API, affecting versions prior to 2026-10-30. This vulnerability allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint, without providing proof of ownership from the identity provider. Exploitation of this vulnerability enables attackers to forge a login using an identifier exposed through account enumeration, granting access to read and modify the victim's profile. Additionally, attackers can delete the account's authentication record, preventing the legitimate user from logging in.
VitaFit has implemented a fix by requiring valid Google and Facebook tokens for authentication through the affected endpoint. This change has been verified and is included in the latest application version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/je-lv/vitafit-security-research | [email protected] | BundleTechnical Analysis |
| https://play.google.com/store/apps/details?id=com.vt.vitafit | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/vitafit-cloud-api-authentication-bypass-via-post-front-login-sns | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VitaFit | < 2026-10-30 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |