Critical severity · published Aug 11, 2026
CVE-2026-68067
Mira Hormone Monitor, Mira Android App Weak Authentication
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mira Android App · Quanovate Tech Inc. (operating as Mira / Mira Care)
4.5.15.4 · source: vendor
MF
Mira Firmware · Quanovate Tech Inc. (operating as Mira / Mira Care)
1.7.1.47 · source: vendor
In the news
VulnerabilityCritical
Mira Hormone Monitor, Mira Android App
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts.
The following versions of Mira Hormone Monitor, Mira Android App are affected:
Mira Monitor Firmware 1.7.1.47 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832)
Mira Android App 4.5.15.4 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832)
CVSS
Vendor
Equipment
Vulnerabilities
v3 9.8
Quanovate Tech Inc. (operating as Mira / Mira Care)
Mira Hormone Monitor, Mira Android App
Missing Authentication for Critical Function, Authentication Bypass by Spoofing, Use of Hard-coded Credentials, Weak Authentication, Improper Restriction of Excessive Authentication Attempts, Reliance on Untrusted Inputs in a Security Decision, Use of GET Request Method With Sensitive Query Strings
Background
Critical Infrastructure Sectors: Healthcare and Public Health
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States
Vulnerabilities
Expand All +
CVE-2026-66875
In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthent...
Aug 11, 2026·CISA Advisories
Affected product
MA
Mira Android App
Quanovate Tech Inc. (operating as Mira / Mira Care)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-68067
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01
More from Mira Android App
9.1
CVE-2026-67568
Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials
8.8
CVE-2026-66875
Mira Hormone Monitor, Mira Android App Missing authentication for critical function
7.4
CVE-2026-67558
Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing
6.5
CVE-2026-66098
Mira Hormone Monitor, Mira Android App Missing authentication for critical function
6.5
CVE-2026-66832
Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings