{"id":"CVE-2026-54384","published":"2026-11-04T23:17:48.523","lastModified":"2026-11-04T23:17:48.523","description":"VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://github.com/je-lv/vitafit-security-research","tags":[]},{"url":"https://play.google.com/store/apps/details?id=com.vt.vitafit","tags":[]},{"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-authentication-bypass-via-post-front-login-sns","tags":[]}],"exploitRefs":[{"url":"https://github.com/je-lv/vitafit-security-research","tags":[]}],"hasPoc":true,"ai":{"summary":"A critical authentication bypass in VitaFit's cloud API before 2026-10-30 allowed unauthenticated attackers to hijack victim accounts by submitting a known social login identifier (e.g., Google/Facebook) to the POST /front/login/sns/ endpoint without verifying ownership, enabling full account takeover.","exploitability":"Exploitation is trivial for remote attackers with no prerequisites beyond knowing a victim's linked social account identifier, which can be obtained via account enumeration.","blast_radius":"Successful exploitation grants attackers full read/write access to victim profiles and the ability to delete authentication records, causing permanent denial of service for legitimate users.","remediation":"Upgrade to VitaFit cloud API version 2026-10-30 or later; until then, disable the POST /front/login/sns/ endpoint or restrict it to authenticated sessions only.","detection":"Look for repeated POST requests to /front/login/sns/ containing social login identifiers without corresponding identity provider verification tokens or session cookies; anomalous spikes in such requests from a single IP or across multiple accounts may indicate enumeration and exploitation attempts.","tags":["auth-bypass","account-takeover","web-api","social-login","enumeration"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:46:32.586Z"}}