Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck
CVE-2026-54384VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
Critical 9.8
In plain English
A critical-severity authentication bypass by spoofing in VitaFit from Shenzhen Shine Industrial Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Shine Industrial Co., Ltd. | VitaFit | 0 – before 2026-10-30 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Researcher Disclosure technical-description, exploit
- Google Play product
- VulnCheck Advisory: VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ third-party-advisory