# CVE-2026-54374: VitaFit Android application hardcoded credentials in third-party integrations

Source: https://junglewise.ai/threats/cve-2026-54374-vitafit-android-application-com-vt-vitafit-before-2-8-1-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-54374 · Severity: high · CVSS 7.5 · Published 2026-11-04

VitaFit is a fitness tracking application for Android that syncs user health data such as weight, BMI, and body composition with cloud services and integrates with third-party platforms like WeChat, Tencent QQ, and Fitbit. The application embedded hardcoded API credentials for these third-party integrations in its code, allowing attackers to extract the secrets by decompiling the APK and abuse the active third-party registrations. This could enable attackers to compromise the connected social and health tracking accounts of VitaFit users.

Technologies: [Shenzhen Shine Industrial VitaFit](https://junglewise.ai/threats/technologies/vitafit). Vendors: [Shenzhen Shine Industrial](https://junglewise.ai/threats/vendors/shenzhen-shine-industrial).

## Quick answers

**Is CVE-2026-54374 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54374 being exploited in the wild.

**How severe is CVE-2026-54374?** High severity, with a CVSS score of 7.5, published 4 November 2026.

**Which products and versions are affected?** Shenzhen Shine Industrial VitaFit before 2.8.1.0.

**Is there a fix for CVE-2026-54374?** Yes: fixed in VitaFit 2.8.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54374 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54374?** Check whether you run Shenzhen Shine Industrial VitaFit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in VitaFit 2.8.1.0

## Technical details

The Android application stored confidential third-party API credentials (WeChat, Tencent QQ, Fitbit, and Facebook) as hardcoded values in the APK, making them trivially recoverable through static analysis and decompilation. An unauthenticated attacker with network access can extract these credentials without any preconditions; the third-party application registrations using these credentials were active at the time of discovery, enabling credential abuse. The vulnerability was patched in version 2.8.1.0 by removing the hardcoded credentials.

## Affected products

- Shenzhen Shine Industrial VitaFit before 2.8.1.0

## Timeline

- 2026-11-04: disclosed
- 2026-11-03: patched

## References

- [https://github.com/je-lv/vitafit-security-research](https://github.com/je-lv/vitafit-security-research)
- [https://play.google.com/store/apps/details?id=com.vt.vitafit](https://play.google.com/store/apps/details?id=com.vt.vitafit)

## Related threats

- [VitaFit cloud API misconfigured storage bucket](https://junglewise.ai/threats/cve-2026-54381-vitafit-cloud-api-before-2026-10-30-contained-a-misconfigured)
- [VitaFit Android app insecure session management](https://junglewise.ai/threats/cve-2026-54375-vitafit-android-application-com-vt-vitafit-before-2-8-1-0)
- [VitaFit Android insecure TLS/SSL certificate validation](https://junglewise.ai/threats/cve-2026-54372-vitafit-android-application-com-vt-vitafit-before-2-8-1-0)