VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or…
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Shenzhen Shine Industrial Co., Ltd.
- Product
- VitaFit
- CVSS v3.1
- 8.4 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-613
- Exposure class
- Mobile OS
- NVD status
- Received
Why it ranks 27 (Notable)
- CVSS v3.1 8.4 high
- Product class: mobile OS
- Widely deployed vendor product (Shenzhen Shine Industrial Co., Ltd.)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-54375 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.