Threats tagged 'ghsa-c27c-369r-q3m7'

The VitaFit Android application (com.vt.vitafit) versions before 2.8.1.0 contain a vulnerability in TLS/SSL certificate validation. This flaw arises from a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname, enabling network-based attackers to intercept and modify HTTPS traffic. Exploitation allows man-in-the-middle attacks to capture account sessions and health-related API data, and attackers can delete authentication records to block legitimate logins.