Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck
CVE-2026-54372VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
High 8.8
In plain English
A high-severity improper certificate validation in VitaFit from Shenzhen Shine Industrial Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Shine Industrial Co., Ltd. | VitaFit | 0 – before 2.8.1.0 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Researcher Disclosure technical-description, exploit
- Google Play product
- VulnCheck Advisory: VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation third-party-advisory