CVE-2026-54372: VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running VitaFit Android versions earlier than 2.8.1.0 are exposed when a network-based attacker can position themselves to intercept the application's HTTPS traffic.
What does an attacker need to exploit this issue?
The attacker does not need application privileges or user interaction. They need network access sufficient to perform a man-in-the-middle attack against the app's HTTPS connections.
What can an attacker do after intercepting traffic?
An attacker can capture account sessions and health-related API data, modify HTTPS traffic, and use a captured session to delete the account's authentication record, preventing the legitimate user from logging in.
Which application versions should be remediated?
The issue affects VitaFit Android application package com.vt.vitafit before version 2.8.1.0. Update affected installations to version 2.8.1.0 or later.