CVE-2026-54384: authentication bypass in VitaFit API

CVE-2026-54384 is a critical authentication bypass in VitaFit cloud API. The vulnerability lies in the POST /front/login/sns/ endpoint used for Google and Facebook login. The service accepts social account identifiers without verifying that the attacker is the legitimate owner at the identity provider. An attacker who knows another person's identifier (easily obtained through account enumeration) can acquire a full authenticated session, completely bypassing the authentication mechanism.

The impact is critical: with a valid session, the attacker reads and modifies the victim's profile, accesses personal data and most importantly deletes authentication records, permanently blocking the legitimate user from accessing their account. The CVSS 9.8 score reflects the absence of technical barriers and maximum damage to confidentiality, integrity and availability. The vulnerability was published on NVD on 2026-11-04 with patch available from 2026-10-30. No confirmed public exploit is reported, but the technical community discusses it actively.

For defense: immediately verify which version of VitaFit cloud API is in production and apply the update with highest priority if prior to 2026-10-30. Review access and authentication logs of the /front/login/sns/ endpoint from recent days to detect anomalous login attempts or unauthorized sessions. Monitor user profiles for suspicious actions executed in recent days. If possible, consider temporary disabling of social login until complete patch verification and system inspection.