Threats tagged 'ghsa-c627-j2cf-hvhm'

The VitaFit Android application (com.vt.vitafit) versions before 2.8.1.0 contain an insecure custom URI scheme vulnerability. This flaw allows a malicious app to register the same callback URI scheme (vitafit://vtio.cn) used by VitaFit to intercept Fitbit login tokens. By capturing the 30-day Fitbit authorization token with weight scope, attackers can access the Fitbit Body API to read, create, and delete the victim's weight and body-fat records.