{"affected":[{"defaultStatus":"unaffected","product":"VitaFit","source":"CNA: VulnCheck","vendor":"Shenzhen Shine Industrial Co., Ltd.","versions":[{"lessThan":"2.8.1.0","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-54374","cwes":["CWE-798"],"description":"VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://github.com/je-lv/vitafit-security-research"}],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793829213033,"publishedAt":1793829213033,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://github.com/je-lv/vitafit-security-research"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://play.google.com/store/apps/details?id=com.vt.vitafit"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/vitafit-android-hardcoded-credentials-disclosure"}],"remediation":[],"revision":"9a10809648fa4f0ed822849bbbbaacfb8fd16e3eaf2b26cadc9b0e5c2e97b63f","sources":[{"modifiedAt":1793829213033,"name":"CNA: VulnCheck","retrievedAt":1793830380208,"url":"https://www.cve.org/CVERecord?id=CVE-2026-54374"}],"ssvc":null,"status":"published","title":"VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure","updatedAt":1793830380208}