CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

CriticalCVSS 9.3

Published: 2026-11-05 00:23
Updated: 2026-11-09 18:55
Exploit status: No public exploit known

Description

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.

Affected products

Product	Affected versions	Fixed in
Shenzhen Shine Industrial Co., Ltd. VitaFit	< 2026-10-30	2026-10-30

References

Researcher Disclosure exploit technical-description
Google Play product
VulnCheck Advisory: VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ third-party-advisory

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.3 · vulncheck
v3.1 9.8 · vulncheck

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-290 Authentication Bypass by Spoofing

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.