Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Shenzhen Shine Industrial VitaFit 2.8.1.0 Clear all filters
TI-2026-85236 CVE-2026-54376 · GHSA-c627-j2cf-hvhm

Custom URI scheme flaw in VitaFit Android lets apps steal Fitbit tokens

Priority LOW 34

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback schem…

CVSS 4.0HIGH 8.2 Local No auth User interaction EPSS 0.00116 Published 2026-11-04 Fixed in 2.8.1.0 CWE-926
TI-2026-85235 CVE-2026-54375 · GHSA-5fv5-qp4h-7jpg

VitaFit Android Long-Lived Session Token Exposure

Priority LOW 36

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backup…

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00151 Published 2026-11-04 Fixed in 2.8.1.0 CWE-613
TI-2026-85234 CVE-2026-54374 · GHSA-25r7-r3v7-g6cq

Hardcoded credentials in VitaFit Android expose third-party secrets

Priority LOW 37

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00268 Published 2026-11-04 Fixed in 2.8.1.0 CWE-798
TI-2026-85233 CVE-2026-54373 · GHSA-4r4r-f5c6-rqj6

Cleartext traffic in VitaFit Android app allows content tampering

Priority LOW 22

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an A…

CVSS 4.0MEDIUM 5.1 Adjacent network No auth User interaction EPSS 0.0011 Published 2026-11-04 Fixed in 2.8.1.0 CWE-319
TI-2026-85232 CVE-2026-54372 · GHSA-c27c-369r-q3m7

Insecure TLS certificate validation in VitaFit Android app

Priority LOW 37

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a cust…

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.00141 Published 2026-11-04 Fixed in 2.8.1.0 CWE-295