Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2024-43201

Planet Fitness Workouts mobile apps do not properly validate TLS certificates

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Planet Fitness Planet Fitness Workouts

Default version status: unknown

  • 0 to < 9.9.13affected
  • 9.9.13unaffected

References