Vulnerability · Published Sep 23, 2024 · Assigned by cisa-cg

CVE-2024-43201Planet Fitness Workouts mobile apps do not properly validate TLS certificates

High 8.8

In plain English

A high-severity improper certificate validation in Planet Fitness Workouts from Planet Fitness. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).

Affected products (as reported)

Vendor	Product	Versions
Planet Fitness	Planet Fitness Workouts	0 – before 9.9.13

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References