VitaFit Android application before version 2.8.1.0 has an insecure session management flaw that stores the m_session_id token unencrypted in application backups, where the token remains valid for ten years. An attacker who obtains a victim’s backup can read or intercept this token. With the stolen token the attacker can read, modify, or delete the victim’s account, or even remove the authentication record, effectively locking the user out. This vulnerability allows complete account takeover and persistence over a long period.

The affected product is the VitaFit Android app (com.vt.vitafit) distributed by Shenzhen Shine Industrial Co., Ltd. All releases earlier than 2.8.1.0 are impacted; no other versions are specified as vulnerable.

The CVSS score of 8.6 classifies it as a high‑impact vulnerability. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker gaining access to the victim’s device or backup files and extracting the unencrypted m_session_id token. Because the token is valid for ten years, the window of opportunity for exploitation is large. Once in possession of the token, an attacker can bypass authentication, read or alter account data, or delete the account’s authentication record to prevent legitimate login.