VitaFit’s cloud API contained a broken access control flaw that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. These credentials are improperly scoped, giving the attacker the ability to list the shared S3 bucket, read files belonging to other users, and overwrite those files. The vulnerability therefore compromises both the confidentiality and integrity of user data across the platform.

The affected product is VitaFit, developed by Shenzhen Shine Industrial Co., Ltd. No specific version range is provided, but the vulnerability applies to releases prior to 2026-10-30.

The CVSS score of 9.3 indicates a critical severity. Although an EPSS score is not available, the lack of a KEV listing does not diminish the risk; the once authenticated user has a direct path to obtain AWS credentials and manipulate data via the bucket. The attack vector is inferred to be a post‑authentication request to the S3 token endpoint, making it potentially exploitable on any system hosting the vulnerable API and used by authenticated users.