CVE-2026-54372

Name of the Vulnerable Software and Affected Versions VitaFit Android application versions prior to 2.8.1.0

Description An insecure TLS/SSL certificate validation issue exists due to a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. This allows network-based attackers to perform a man-in-the-middle attack to intercept and modify HTTPS traffic. Such an attack can be used to capture account sessions and health-related API data, or to delete the authentication record of an account to prevent legitimate login.

Recommendations Update to version 2.8.1.0 or later.