CVE-2026-54384: VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.
Event History
Frequently Asked Questions
Which accounts are exposed?
Accounts with a linked Google or Facebook identity are exposed if they are handled by a VitaFit cloud API version before 2026-10-30. The issue is remotely reachable and requires no prior authentication.
What does an attacker need to exploit the issue?
The attacker needs a linked Google or Facebook account identifier for the victim. The endpoint does not require proof that the attacker controls the corresponding identity-provider account.
What is the potential impact after a successful login forgery?
An attacker can obtain a full session for the victim account, read and modify the victim's profile, and delete the account's authentication record. Deleting that record can prevent the legitimate user from logging in.