CVE-2026-54374

Received Received - Intake

Hardcoded Credentials in VitaFit Android App

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54374

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

The VitaFit Android app (com.vt.vitafit) before version 2.8.1.0 has hardcoded credentials that attackers can extract by decompiling the APK. These credentials include secrets for third-party integrations like WeChat, Tencent QQ, and Fitbit, allowing attackers to misuse the app's active registrations with these services.

Detection Guidance

Detecting this vulnerability requires analyzing the VitaFit Android application (com.vt.vitafit) for hardcoded credentials. Decompile the APK using tools like apktool or jadx and inspect for embedded secrets related to WeChat, Tencent QQ, or Fitbit integrations.

Impact Analysis

Attackers could use the exposed credentials to gain unauthorized access to your third-party accounts linked through the VitaFit app, potentially leading to data breaches, unauthorized transactions, or misuse of your personal information across connected services.

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by exposing user data through insecure credentials. Organizations using the app may face compliance penalties, legal liabilities, and reputational damage due to unauthorized access to sensitive user information.

Mitigation Strategies

Update the VitaFit application to version 2.8.1.0 or later to remove hardcoded credentials. If an update is unavailable, remove the application until a patched version is released. Review third-party integrations for unauthorized access and revoke compromised credentials.

Hi! I’m here to help you understand CVE-2026-54374. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...