Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck
CVE-2026-54376VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
High 8.2
In plain English
A high-severity security flaw in VitaFit from Shenzhen Shine Industrial Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Shine Industrial Co., Ltd. | VitaFit | 0 – before 2.8.1.0 |
Weakness: CWE-926 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- Researcher Disclosure technical-description, exploit
- Google Play product
- VulnCheck Advisory: VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking third-party-advisory