Description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Shine Industrial | VitaFit | < 2.8.1.0 | 2.8.1.0 |
References
- Researcher Disclosure technical-description exploit
- Google Play product
- VulnCheck Advisory: VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure third-party-advisory