CVE-2026-67558
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mira Firmware
- Vendor
- Quanovate Tech Inc. (operating as Mira / Mira Care)
- Product
- Mira Firmware
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.7.1.47 | affected | custom | Unavailable | Unavailable | None listed |
Mira Android App
- Vendor
- Quanovate Tech Inc. (operating as Mira / Mira Care)
- Product
- Mira Android App
- Platforms
- Android
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.5.15.4 | affected | custom | Unavailable | Unavailable | None listed |