AI Service Vulnerability in SparkyFitness Tracker by CodeWithCJ
CVE-2026-102923

5.4MEDIUM

Key Information:

Vendor

Codewithcj

Status
Sparkyfitness
Vendor
CVE Published:
16 October 2026

What is CVE-2026-102923?

SparkyFitness, a self-hosted AI-powered health and fitness tracker, suffers from a security vulnerability where certain components fail to accurately validate user-supplied URLs in custom AI service settings. This flaw allows authenticated users to save malicious URLs, which can lead to unauthorized outbound POST requests using a manipulated bearer token. The successful exploitation of this issue may enable attackers to probe internal services and potentially expose sensitive information, including the AI system's prompt. This vulnerability was addressed in the release of version 1.6.0.

Affected Version(s)

SparkyFitness < 1.6.0

References

https://github.com/CodeWithCJ/SparkyFitness/security/advi...
x_refsource_CONFIRM
https://github.com/CodeWithCJ/SparkyFitness/commit/0b43a3...
x_refsource_MISC
https://github.com/CodeWithCJ/SparkyFitness/releases/tag/...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.