CVE-2026-54375

Received Received - Intake

Session Token Exposure in VitaFit Android App

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54375

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

The VitaFit Android app before version 2.8.1.0 has an insecure session management flaw. It stores unencrypted m_session_id tokens in application backups, which attackers can extract or intercept. These tokens remain valid for ten years, allowing unauthorized access to user accounts.

Detection Guidance

Check for unencrypted m_session_id tokens in application backups or logs. Inspect VitaFit app data directories for session tokens stored insecurely. Use file search commands to locate backup files containing these tokens.

Impact Analysis

Attackers can use stolen session tokens to read or modify your account data, delete your authentication record, or lock you out of your account. This could lead to loss of access, privacy breaches, or unauthorized changes to your personal information.

Compliance Impact

This vulnerability likely violates GDPR due to inadequate protection of personal data and potential unauthorized access. It may also breach HIPAA if health-related data is exposed. Organizations must ensure session tokens are encrypted and access is properly secured to maintain compliance.

Mitigation Strategies

Update VitaFit Android app to version 2.8.1.0 or later. Avoid storing session tokens in backups. Revoke any exposed session tokens and monitor for unauthorized account access.

Hi! I’m here to help you understand CVE-2026-54375. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...