Vulnerability details
CVE-2026-68067
Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android AppQuanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
Mira Hormone Monitor, Mira Android App Weak Authentication
CVSS 4.0
9.3Critical
Official description
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (icscert) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (icscert) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App | 4.5.15.4 | CVEProject cvelistV5 (CNA) |
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware | 1.7.1.47 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-12
- Last updated
- 2026-08-12
- State
- Published
- Assigner (CNA)
- icscert
Exploit prediction (EPSS)
0.51%
Probability of exploitation in 30 days
43.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1390Weak Authentication