Vulnerability · Published Aug 11, 2026 · Assigned by icscert
CVE-2026-67558Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing
High 7.4
In plain English
A high-severity authentication bypass by spoofing in Mira Android App from Quanovate Tech Inc. (operating as Mira / Mira Care). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware | 1.7.1.47 |
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App | 4.5.15.4 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N