Threats tagged 'ghsa-5fv5-qp4h-7jpg'

The VitaFit Android application (com.vt.vitafit) versions before 2.8.1.0 have an insecure session management vulnerability. This flaw allows attackers to extract or intercept unencrypted session tokens (m_session_id) from application backups. These tokens remain valid for ten years, enabling attackers to read, modify, or delete the victim's account authentication data, potentially locking out the legitimate user.