CVE-2026-54376
8.2 HIGHpublic exploit availablePublished 2026-11-04 · Updated 2026-11-04
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-926
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-107014PoC
- HIGHCVE-2026-107019PoC
- CRITICALCVE-2026-107021PoC
- HIGHCVE-2026-107025PoC
- CRITICALCVE-2026-107027PoC
- HIGHCVE-2026-107030PoC
- CRITICALCVE-2026-107032PoC
- MEDIUMCVE-2026-107033PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.