CVE-2026-54384 is a critical authentication bypass in the VitaFit cloud API: an attacker can get a full session for another user's account by submitting only that account's linked Google or Facebook identifier.
What Is It
CVE-2026-54384 is an authentication bypass in the VitaFit cloud API, made by Shenzhen Shine Industrial Co., Ltd. It is classified as CWE-290 (Authentication Bypass by Spoofing). VulnCheck disclosed it, and NVD published it on 2026-11-04.
The flaw is in the POST /front/login/sns/ endpoint, which handles social sign-in. The API accepted a linked Google or Facebook account identifier without asking the identity provider for proof that the person sending it owns that account. An attacker who has a victim's identifier can forge a login and receive a full session for that account. According to the record, these identifiers are exposed through account enumeration.
Why It Matters
NVD lists a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. VulnCheck's CVSS 4.0 score is 9.3 (CRITICAL). The attack works over the network, has low complexity, and needs no privileges and no action from the victim.
Once an attacker has a session, they can:
- Read the victim's profile data
- Modify the victim's profile
- Delete the account's authentication record, which locks the real user out
Because the identifiers can be found through enumeration, the flaw could be used against any VitaFit user who has linked a Google or Facebook account.
Exploitation status: As of publication (2026-11-04), CVE-2026-54384 did not appear in CISA's Known Exploited Vulnerabilities catalog. That means CISA has not confirmed active exploitation. It does not mean the flaw has not been exploited, and CISA may add it later. Check the catalog for the current status.
What's Vulnerable
- Vendor: Shenzhen Shine Industrial Co., Ltd.
- Product: VitaFit cloud API
- Affected: versions before 2026-10-30 (date-based versioning)
- Endpoint:
POST /front/login/sns/
NVD tags the record "exclusively-hosted-service." That means the flaw is in the vendor's hosted backend, not in software that customers install. The VitaFit Android app is listed as a reference. NVD has not published any CPE entries yet, and the record's status is "Received."
Patch Status
The record lists the cloud API as affected before 2026-10-30. Because this is a hosted service, any fix would be applied by the vendor on its own servers, not installed by users. The available data does not include a vendor advisory, a confirmed fix, or any required action. While the CVE is not in the KEV catalog, there is no CISA remediation deadline. Users who linked Google or Facebook sign-in should check that their profile data is intact and that they can still log in.