CVE-2026-54376

Received Received - Intake

Insecure Custom URI Scheme in VitaFit Android App Allows Token Theft

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54376

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-926	The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

Executive Summary

The VitaFit Android app before version 2.8.1.0 has an insecure custom URI scheme flaw. It allows a malicious app to register the same callback scheme (vitafit://vtio.cn) used by Fitbit login. This lets attackers intercept the 30-day Fitbit authorization token sent in the callback URL, which grants access to read, create, or delete the victim's weight and body-fat records via the Fitbit Body API.

Detection Guidance

Check installed Android applications for VitaFit (com.vt.vitafit) versions older than 2.8.1.0. Inspect app manifest files for custom URI schemes like vitafit://vtio.cn. Monitor network traffic for Fitbit API callbacks to unauthorized endpoints.

Impact Analysis

If you use the vulnerable VitaFit app, an attacker could steal your Fitbit login token. This would let them access your weight and body-fat data, potentially leading to privacy breaches, unauthorized data manipulation, or misuse of your health information.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR and HIPAA by exposing sensitive health data without consent. GDPR requires protecting personal data, while HIPAA mandates safeguards for health information. The breach risks non-compliance and potential legal penalties.

Mitigation Strategies

Update VitaFit to version 2.8.1.0 or later. Remove or disable the vulnerable app if updates are unavailable. Revoke Fitbit authorization tokens and review API access permissions for suspicious activity.

Hi! I’m here to help you understand CVE-2026-54376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...