CVE-2026-54376: VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking

Q: Who is exposed to this issue?

Users of the VitaFit Android application version earlier than 2.8.1.0 are exposed when they complete a Fitbit login flow. A malicious application installed on the same device can register the VitaFit callback scheme and receive the authorization callback.

Q: What does an attacker need to exploit it?

The attacker needs to get a malicious application installed on the victim's Android device and register the same vitafit://vtio.cn callback scheme. Exploitation also requires the victim to interact with the Fitbit login flow.

Q: What can an intercepted token allow an attacker to do?

The intercepted 30-day Fitbit authorization token has weight scope. It can be used through the Fitbit Body API to read, create, and delete the victim's weight and body-fat records.

Q: What should users do if they cannot immediately update?

The provided data identifies versions before 2.8.1.0 as affected. Until updating, users should treat Fitbit login activity in the affected app as exposed to interception by another installed application using the same callback scheme.

Published Nov 4, 2026

Updated

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.

Event History

Nov 4, 2026

CVE Published

via MITRE·10:01 PM

Data Sourced

via MITRE·10:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of the VitaFit Android application version earlier than 2.8.1.0 are exposed when they complete a Fitbit login flow. A malicious application installed on the same device can register the VitaFit callback scheme and receive the authorization callback.

What does an attacker need to exploit it?

The attacker needs to get a malicious application installed on the victim's Android device and register the same vitafit://vtio.cn callback scheme. Exploitation also requires the victim to interact with the Fitbit login flow.

What can an intercepted token allow an attacker to do?

The intercepted 30-day Fitbit authorization token has weight scope. It can be used through the Fitbit Body API to read, create, and delete the victim's weight and body-fat records.

What should users do if they cannot immediately update?

The provided data identifies versions before 2.8.1.0 as affected. Until updating, users should treat Fitbit login activity in the affected app as exposed to interception by another installed application using the same callback scheme.

CVE-2026-54376: VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an intercepted token allow an attacker to do?

What should users do if they cannot immediately update?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an intercepted token allow an attacker to do?

What should users do if they cannot immediately update?