CVE-2026-54378
Critical
Description
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.
SeverityCritical
CVSS9.6
Exploit probability14. percentile0.2%
ProductVitaFit
PublishedNov 4, 2026
First seenNov 4, 2026
Weakness typeCWE-522CWE-522
How to fix
Update
- Shenzhen Shine Industrial Co., Ltd. VitaFit2026-10-30 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Shenzhen Shine Industrial Co., Ltd. VitaFit | v < 2026-10-30 | 2026-10-30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.