CVE-2024-43201
High
Description
The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).
SeverityHigh
CVSS8.8
Exploit probability—
ProductPlanetfitness Planet Fitness Workouts
PublishedSep 23, 2024
First seenSep 23, 2024
Weakness typeCWE-295CWE-295
How to fix
Update
- planetfitness planet_fitness_workouts9.8.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| planetfitness planet_fitness_workouts | v < 9.8.12 | 9.8.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.