Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

VitaFit Cloud API lets attackers log in as any user

CVE-2026-54384 · published 4 days ago
Summary

The VitaFit cloud service allows anyone to create a valid session by sending a Google or Facebook account ID to a login endpoint, without proving they own that account. This lets a remote attacker read, change, or even delete a victim’s profile and block the real user from signing in. Apply the vendor’s update released after October 30, 2026, and make sure all social‑login integrations verify ownership before granting access.

What to do
  • Update shenzhen shine industrial co., ltd. vitafit to version 2026-10-30 or later.
Affected software
VendorProductAffected versions
shenzhen shine industrial co., ltd. vitafit < 2026-10-30
Original advisory text
VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published4 Nov 2026
Updated7 Nov 2026
First seen4 Nov 2026
Sources
CVE-2026-54384 · NVD
CVE-2026-54384 · MITRE
Track software like this
Free during beta