CVE-2026-54372

Received Received - Intake

Insecure TLS/SSL Certificate Validation in VitaFit Android App

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54372

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

The VitaFit Android app before version 2.8.1.0 has a critical flaw in its TLS/SSL certificate validation. It uses a custom X509TrustManager that blindly trusts all certificates and a hostname verifier that accepts any hostname, allowing attackers to intercept and modify HTTPS traffic via man-in-the-middle attacks.

Detection Guidance

Detect this vulnerability by inspecting the VitaFit Android app (com.vt.vitafit) version before 2.8.1.0. Check for custom X509TrustManager implementations that trust all certificates and hostname verifiers that accept any hostname. Use static analysis tools like MobSF or APKTool to decompile the APK and review the code for insecure TLS/SSL validation logic.

Impact Analysis

Attackers can capture your account sessions and health-related API data. They may also delete your authentication record, preventing you from logging in to the app.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized data interception and HIPAA if health data is exposed. It compromises data confidentiality and integrity, leading to potential compliance violations.

Mitigation Strategies

Immediately update the VitaFit Android app to version 2.8.1.0 or later. If an update is not available, uninstall the app to prevent exposure. Monitor network traffic for suspicious activity and revoke any potentially compromised session tokens. Report the issue to the app vendor if not already addressed.

Hi! I’m here to help you understand CVE-2026-54372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...