Is CVE-2026-54375 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54375 being exploited in the wild.

How severe is CVE-2026-54375?

High severity, with a CVSS score of 8.4, published 4 November 2026.

Which products and versions are affected?

Shenzhen Shine Industrial VitaFit before 2.8.1.0.

Is there a fix for CVE-2026-54375?

Yes: fixed in VitaFit 2.8.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54375 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-54375?

Check whether you run Shenzhen Shine Industrial VitaFit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54375: VitaFit Android app insecure session management

CVE-2026-54375 · Severity: high · CVSS 8.4 · Published 2026-11-04

VitaFit is a fitness tracking app that syncs weight, body composition, and health data with cloud services. The app stores unencrypted session tokens in device backups that remain valid for a decade, allowing an attacker who gains access to a backup to hijack an account, read personal health data, modify records, or lock out the legitimate owner.

Technologies: Shenzhen Shine Industrial VitaFit. Vendors: Shenzhen Shine Industrial.

Quick answers

Is CVE-2026-54375 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54375 being exploited in the wild.
How severe is CVE-2026-54375?: High severity, with a CVSS score of 8.4, published 4 November 2026.
Which products and versions are affected?: Shenzhen Shine Industrial VitaFit before 2.8.1.0.
Is there a fix for CVE-2026-54375?: Yes: fixed in VitaFit 2.8.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54375 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-54375?: Check whether you run Shenzhen Shine Industrial VitaFit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: VitaFit 2.8.1.0

Technical details

Session tokens (m_session_id) are stored in cleartext within the Android SharedPreferences with a 10-year expiry time, and remain accessible when an attacker extracts application backups. An attacker with the stolen token can authenticate to the cloud service without the password and perform all account operations including data deletion. The vulnerability affects the Android application and session management service in VitaFit 2.8.0.4.

Affected products

Shenzhen Shine Industrial VitaFit before 2.8.1.0

Timeline

2026-11-04: disclosed: CVE-2026-54375 published
2026-11-03: advisory: Responsible disclosure published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.