CVE-2026-54376

Name of the Vulnerable Software and Affected Versions VitaFit versions prior to 2.8.1.0

Description The application uses an insecure custom URI scheme that allows a malicious app to intercept Fitbit login tokens by registering the same callback scheme vitafit://vtio.cn. An attacker can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL, enabling them to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.

Recommendations Update to version 2.8.1.0 or later.