CVE ID :CVE-2026-54378 Published : Nov. 4, 2026, 10:18 p.m. | 48 minutes ago Description :VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/...

#Sicherheitslücke #Cloud

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-54378 - VitaFit Cloud API Broken Access Control via S3 Token Endpoint

VERWANDTEARTIKEL

CVE-2026-54384 - VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

CVE-2026-57567 - Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview

CVE-2026-97693 - Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

CVE-2026-55368 - h2o: buffer overflow when using the %{error}x log directive

CVE-2026-57566 - Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

CVE-2026-54374 - VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure