CVE-2026-68067

Mira Hormone Monitor, Mira Android App Weak Authentication

CVSS 9.3 critical · Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware · published 2026-08-11

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

NVD · CVE.org

Coverage 1 source

1. 2026-08-11 CISA Cybersecurity Advisories high Mira Hormone Monitor, Mira Android App

   Multiple vulnerabilities in Mira Hormone Monitor and Mira Android App could allow unauthorized access and control.

Mentioned with

CVE-2026-66098 CVE-2026-66340 CVE-2026-66875 CVE-2026-67558 CVE-2026-67568

Also covered

• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 1 article · 2026-09-29
• CVE-2023-6548 Cloud Software Group NetScaler ADC CVSS 5.5 · 1 article · 2026-09-28
• CVE-2023-25608 Fortinet FortiAP-W2 CVSS 5.2 · 1 article · 2026-09-28
• CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVSS 9.5 · 3 articles · 2026-09-28
• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 3 articles · 2026-09-28