CVE-2026-68067
Mira Hormone Monitor, Mira Android App Weak Authentication
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
| CWE | CWE-1390 |
| Vendor | quanovate tech inc. (operating as mira / mira care) |
| Product | mira firmware |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for quanovate tech inc. (operating as mira / mira care) mira firmware
Be the first to know when new critical vulnerabilities affecting quanovate tech inc. (operating as mira / mira care) mira firmware are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Quanovate Tech Inc. (operating as Mira / Mira Care) / Mira Firmware
1.7.1.47
Quanovate Tech Inc. (operating as Mira / Mira Care) / Mira Android App
4.5.15.4
References
Credits
Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong of Northeastern University SPQR Lab reported this vulnerability to Quanovate Tech.