CVE-2026-54374: VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.
Event History
Frequently Asked Questions
Which installations should be considered affected?
VitaFit Android application package com.vt.vitafit versions before 2.8.1.0 are affected.
What does an attacker need to exploit this issue?
An attacker needs access to the VitaFit APK and can extract the embedded secrets by decompiling it. The supplied severity vector indicates network access, privileges, and user interaction are not required.
Which integrations may be exposed if the credentials are recovered?
The embedded credentials are associated with WeChat, Tencent QQ, and Fitbit third-party integrations. The disclosed risk is abuse of the active application registrations for those services.