CVE-2026-54376 in VitaFit
Summary
by MITRE • 11/05/2026
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The VitaFit Android application, specifically versions prior to 2.8.1.0, suffers from a critical insecure custom URI scheme vulnerability that fundamentally compromises the integrity of its authentication flow. This flaw stems from the improper implementation of deep linking mechanisms within the app's architecture. The application utilizes a specific callback URL scheme, identified as vitafit://vtio.cn, to receive authorization tokens following user login via third-party services such as Fitbit. In Android environments, custom URI schemes must be registered with explicit intent filters that include category and action specifications to ensure they are only triggered by intended sources. However, the vulnerability arises because the application fails to adequately restrict or validate these incoming intents, allowing any installed application on the device to register a listener for this specific scheme. This lack of strict component export controls creates an open channel through which sensitive data can be intercepted without user interaction or consent.
The operational impact of this flaw is severe, as it enables malicious applications to perform token interception attacks against users who utilize VitaFit with Fitbit integration. When a victim initiates the login process, the application generates a temporary authorization code and redirects the browser or in-app web view back to the custom URI scheme containing the access tokens. Because the vulnerability allows any app on the device to claim this callback URL, an attacker can install a malicious companion app that registers for the vitafit://vtio.cn intent filter. As soon as the legitimate VitaFit application attempts to process the login response, the malicious app intercepts the redirect before VitaFit can securely handle it. The intercepted payload contains a 30-day Fitbit authorization token with weight scope permissions. This long-lived credential effectively grants the attacker persistent access to the victim's account for an extended period, bypassing standard session expiration protections that would normally limit exposure in case of compromise.
Once the malicious application captures these tokens, it can directly interact with the Fitbit Body API on behalf of the victim. The scope associated with the intercepted token includes permissions to read, create, and delete weight and body-fat records. This capability allows an attacker not only to exfiltrate sensitive personal health information but also to manipulate the user's data by injecting false metrics or deleting existing entries. Such manipulation can have significant consequences for individuals who rely on these applications for medical monitoring, fitness tracking, or dietary management. The ability to alter biometric data undermines trust in digital health tools and poses potential risks if this data is used for insurance assessments or personal health decisions. This scenario exemplifies a classic case of insecure direct object references combined with improper authorization checks within the mobile application's communication layer.
From a classification perspective, this vulnerability aligns closely with CWE-200, which covers exposure of sensitive information to an unauthorized actor, and more specifically CWE-643, describing improper handling of URL schemes in Android applications where exported components are not properly secured. In terms of the MITRE ATT&CK framework for mobile platforms, this attack vector corresponds to T1589.002, which involves gathering victim credentials through phishing or malicious apps that exploit system-level permissions and intent interception capabilities. The attacker leverages the trust relationship between the operating system and application components to bypass security boundaries that are typically enforced by user consent dialogs.
To mitigate this vulnerability, developers must implement strict validation for incoming intents associated with custom URI schemes. This includes ensuring that exported activities or services handling these callbacks require explicit permissions or verify the calling package name against a whitelist of trusted sources. Additionally, implementing OAuth 2.0 PKCE (Proof Key for Code Exchange) is essential to prevent authorization code interception attacks even if the callback URL scheme is compromised. By adding a dynamic challenge parameter during the initial authorization request and verifying it upon token exchange, applications can ensure that only the legitimate client application can complete the authentication flow. Furthermore, updating to version 2.8.1.0 or later resolves this issue by patching the underlying intent filter configurations and strengthening the security posture of the deep linking mechanism. Users should immediately update their VitaFit application to the latest available version to prevent potential exploitation of this credential interception flaw.