Description
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Shine Industrial | VitaFit | < 2026-10-30 | 2026-10-30 |
References
- Researcher Disclosure technical-description exploit
- Google Play product
- VulnCheck Advisory: VitaFit Cloud API Broken Access Control via S3 Token Endpoint third-party-advisory