Bug 2567482 (CVE-2026-54376)
| Summary: | CVE-2026-54376 VitaFit: VitaFit: Authentication token interception via insecure custom URI scheme | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the VitaFit application. This vulnerability is caused by an insecurely handled custom Uniform Resource Identifier (URI) scheme used during account authentication. A malicious application installed on the same device can register the same URI scheme to intercept authentication tokens during the login process. An attacker can exploit this flaw to view, create, or delete the user's personal health and fitness records without authorization.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-05 22:01:30 UTC
|