CVE-2026-54384

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30

Description An authentication bypass allows remote attackers to obtain a full session for a victim's account. This is achieved by submitting a linked Google or Facebook account identifier to the 'POST /front/login/sns/' endpoint without providing proof of ownership from the identity provider. Attackers can use identifiers obtained through account enumeration to read and modify victim profiles or delete authentication records, which prevents legitimate users from accessing their accounts.

Recommendations Update VitaFit cloud API to a version released on or after 2026-10-30.