CVE-2026-54384

Summary

A critical authentication bypass in VitaFit's cloud API before 2026-10-30 allowed unauthenticated attackers to hijack victim accounts by submitting a known social login identifier (e.g., Google/Facebook) to the POST /front/login/sns/ endpoint without verifying ownership, enabling full account takeover.

Exploitability

Exploitation is trivial for remote attackers with no prerequisites beyond knowing a victim's linked social account identifier, which can be obtained via account enumeration.

Blast radius

Successful exploitation grants attackers full read/write access to victim profiles and the ability to delete authentication records, causing permanent denial of service for legitimate users.

Detection

Look for repeated POST requests to /front/login/sns/ containing social login identifiers without corresponding identity provider verification tokens or session cookies; anomalous spikes in such requests from a single IP or across multiple accounts may indicate enumeration and exploitation attempts.

Prioritized remediation

Upgrade to VitaFit cloud API version 2026-10-30 or later; until then, disable the POST /front/login/sns/ endpoint or restrict it to authenticated sessions only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.