CVE ID :CVE-2026-54384
Published : Nov. 4, 2026, 11:17 p.m. | 1 hour, 48 minutes ago
Description :VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim’s account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim’s profile and delete the account’s authentication record, preventing the legitimate user from logging in.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Published : Nov. 4, 2026, 11:17 p.m. | 1 hour, 48 minutes ago
Description :VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim’s account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim’s profile and delete the account’s authentication record, preventing the legitimate user from logging in.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more…