CVE-2026-54375
High
Description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.
SeverityHigh
CVSS8.4
Exploit probability—
ProductVitaFit
PublishedNov 4, 2026
First seenNov 4, 2026
Weakness typeCWE-613CWE-613
How to fix
Update
- Shenzhen Shine Industrial Co., Ltd. VitaFit2.8.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Shenzhen Shine Industrial Co., Ltd. VitaFit | v < 2.8.1.0 | 2.8.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.