PT-2026-137200
CVE-2026-54375
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
8.4
HighMetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
VitaFit Android application versions prior to 2.8.1.0
Description
Insecure session management allows the extraction or interception of unencrypted
m session id tokens stored in application backups. These tokens remain valid for ten years, enabling an attacker to read and modify the victim's account or delete the authentication record to prevent the legitimate owner from logging in.Recommendations
Update to version 2.8.1.0 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾