Low 5.1

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic...

CVE-2026-54373 First seen on SecPulse Nov 5, 06:51

Affected packages

Ecosystem	Package	Affected	Fixed
Shenzhen Shine Industrial Co., Ltd.	VitaFit	< 2.8.1.0	2.8.1.0

Original description The description as published by the source.

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Low 3.5; CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4: Medium 5.1; CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Nov 5, 2026
First seen on SecPulse: Nov 5, 06:51
GHSA: GHSA-4r4r-f5c6-rqj6
CWE: CWE-319

NVD GitHub Advisory

Tags(click for explanation)

All

CWE-319 Shenzhen Shine Industrial Co Ltd Vitafit

Detection sources

NIST National Vulnerability Database00:15
GitHub Security Advisories (Global)Nov 5, 09:33
CVE.org (CVE Program・cvelistV5)Nov 5, 06:51