Cleartext Traffic Vulnerability in VitaFit Android Application
CVE-2026-54373

5.1MEDIUM

Key Information:

Vendor

Shenzhen Shine Industrial Co., Ltd.

Status
Vitafit
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-54373?

The VitaFit Android application, specifically versions prior to 2.8.1.0, is vulnerable to cleartext traffic exposure. This vulnerability arises from the application's lack of an appropriate network security configuration, allowing network-based attackers to intercept or modify unencrypted HTTP traffic. As a result, users on untrusted networks may encounter manipulated content, endangering their data integrity and privacy. The potential for such exploitation underscores the importance of implementing robust security measures within mobile applications.

Affected Version(s)

VitaFit 0 < 2.8.1.0

References

https://github.com/je-lv/vitafit-security-research
technical-descriptionexploit
https://play.google.com/store/apps/details?id=com.vt.vitafit
product
https://www.vulncheck.com/advisories/vitafit-android-clea...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jose Lomeli
.