Threats affecting pkg:github/je-lv/vitafit-security-research

VitaFit cloud API versions before 2026-10-30 have an authentication bypass vulnerability that allows remote attackers to impersonate users by submitting linked Google or Facebook account identifiers without proof of ownership. This flaw enables attackers to fully access victim accounts, modify profiles, and delete authentication records, blocking legitimate user access. The vulnerability is critical and has been fixed as of 2026-10-30.

CVE-2026-54383 is a vulnerability in the VitaFit cloud API by Shenzhen Shine Industrial Co., Ltd. affecting versions before 2026-10-30. It allows any authenticated user to access the GET /front/relation/search/ endpoint without proper authorization, exposing personally identifiable information (PII) and health-related profile data. The exposed data includes user identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs. The vulnerability was fixed in the version released on 2026-10-30.