The Android application was found to embed sensitive credentials for third‑party services, namely WeChat, Tencent QQ, and Fitbit, directly in the code. Decompiling the APK allows attackers to recover these hardcoded secrets and use them to impersonate legitimate users or perform unauthorized actions against the associated third‑party platforms. This results in a loss of confidentiality and potentially enables further exploitation within those external ecosystems.

Shenzhen Shine Industrial Co., Ltd. provides the VitaFit application (com.vt.vitafit) for Android. All releases prior to version 2.8.1.0 are affected, including the latest public builds available on the Google Play Store.

The CVSS score of 8.7 indicates a high severity level, and although the EPSS score is not available, the lack of a KEV listing does not lower the risk. Attackers only need to obtain a copy of the application package and perform offline decompilation, which is straightforward with standard tools. Once the credentials are extracted, they can be leveraged immediately to abuse third‑party registration and access private data, making the threat realistic and actionable for adversaries with moderate technical skill.