Threats tagged 'ghsa-gx2r-4x57-mvww'

VitaFit cloud API versions before 2026-10-30 have an authentication bypass vulnerability. Remote attackers can submit a linked Google or Facebook account identifier to the login endpoint without proof of ownership, gaining full session access to the victim's account. This allows attackers to read and modify the victim's profile and delete authentication records, blocking legitimate user access.