CVE-2026-54384

Received Received - Intake

Authentication Bypass in VitaFit Cloud API

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54384

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

VitaFit cloud API before 2026-10-30 had an authentication bypass flaw. Attackers could exploit it by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without proving ownership. This allowed them to gain full session access to a victim's account, enabling profile access, modifications, and account deletion.

Impact Analysis

If exploited, attackers could take over your VitaFit account, access sensitive data, modify your profile, or delete your account entirely. This could lead to loss of personal data, unauthorized changes, and permanent account lockout for the legitimate user.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data and failing to ensure data integrity and confidentiality. For HIPAA, it may compromise protected health information if stored in the account, leading to breaches of security and privacy requirements.

Mitigation Strategies

Update VitaFit cloud API to version 2026-10-30 or later to address the authentication bypass vulnerability. Ensure all authentication flows for linked Google or Facebook accounts require proof of ownership from the identity provider.

Hi! I’m here to help you understand CVE-2026-54384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...