Insecure Custom URI Scheme Vulnerability in VitaFit Android Application
CVE-2026-54376

8.2HIGH

Key Information:

Vendor

Shenzhen Shine Industrial Co., Ltd.

Status
Vitafit
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-54376?

The VitaFit Android application, prior to version 2.8.1.0, is susceptible to an insecure custom URI scheme vulnerability. This flaw permits a malicious application to hijack Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Consequently, attackers can capture the 30-day Fitbit authorization token embedded in the callback URL, which grants them the capability to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API. This vulnerability poses significant risks as it may allow unauthorized access to sensitive health data.

Affected Version(s)

VitaFit 0 < 2.8.1.0

References

https://github.com/je-lv/vitafit-security-research
technical-descriptionexploit
https://play.google.com/store/apps/details?id=com.vt.vitafit
product
https://www.vulncheck.com/advisories/vitafit-android-cust...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jose Lomeli
.