Answer in brief
CVE-2026-54384 records a Critical severity (CVSS 9.3) vulnerability in VitaFit Cloud API Authentication Bypass via POST /front/login/sns/. The current sources do not mark it as known exploited. The current feed maps Shenzhen Shine Industrial Co., Ltd./VitaFit (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Shenzhen Shine Industrial Co., Ltd./VitaFit (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Shenzhen Shine Industrial Co., Ltd./VitaFitgeneric | >=0 <2026-10-30 | 2026-10-30 |
Published upstream
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 4, 2026
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.
Quoted source text, attributed separately from HOL analysis.