Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE Shenzhen Shine Industrial Co. VitaFit: authentication bypass in SNS login endpoint (CVE-2026-54384) Remote attackers can hijack accounts via linked Google or Facebook IDs, read or alter profiles, and lock users out. Patch → 2026-10-30 https://cve.now/CVE-2026-54384?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
CVE-2026-54384 VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by s… https://www.cve.org/CVERecord?id=CVE-2026-54384