CVE-2026-102923

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.

• CWE-918

• https://github.com/CodeWithCJ/SparkyFitness/commit/0b43a37003a3fbedf4e38058130460fd4707fe29
• https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0
• https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3
• https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3

Published

Oct 16, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102914Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-102915Subscriber Broken Access Control in WPO365 <= 44.1 versions.8.5
• CVE-2026-102916A reachable assertion in the illumos bhyve instruction emula…6.8
• CVE-2026-102917IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticat…7.8
• CVE-2026-102918The Redux Framework plugin for WordPress is vulnerable to St…6.4
• CVE-2026-10292A vulnerability was detected in UTT HiPER 1200GW up to 2.5.3…8.8
• CVE-2026-102925virtualenv is a tool for creating isolated virtual python en…7.8
• CVE-2026-10293A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306…8.8
• CVE-2026-102930virtualenv is a tool for creating isolated virtual python en…7.7
• CVE-2026-102937virtualenv is a tool for creating isolated virtual python en…7.3
• CVE-2026-102938virtualenv is a tool for creating isolated virtual python en…5.8
• CVE-2026-10294A vulnerability has been found in PackageKit up to 1.3.5. Af…4.3