Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE Shenzhen Shine Industrial Co. VitaFit: broken access control in S3 token endpoint (CVE-2026-54378) A remote attacker with a basic account can get overly broad AWS credentials and read or overwrite others' files. Patch → 2026-10-30 https://cve.now/CVE-2026-54378?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
🔴 Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Cloud API Broken Access Control via S3 Token Endpoint (CVE-2026-54378) Fix → 2026-10-30 https://agentprime.io/advisories/CVE-2026-54378/
CVE-2026-54378 VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling … https://www.cve.org/CVERecord?id=CVE-2026-54378