CVE-2026-54372

HIGH 8.8

VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.

CWE	CWE-295
Vendor	shenzhen shine industrial co., ltd.
Product	vitafit
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for shenzhen shine industrial co., ltd. vitafit

Be the first to know when new high vulnerabilities affecting shenzhen shine industrial co., ltd. vitafit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Shenzhen Shine Industrial Co., Ltd. / VitaFit

0 < 2.8.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/je-lv/vitafit-security-research play.google.com: https://play.google.com/store/apps/details?id=com.vt.vitafit vulncheck.com: https://www.vulncheck.com/advisories/vitafit-android-insecure-tls-certificate-validation

Credits

Jose Lomeli