Vulnerability

Mira’s cloud login accepted any password and returned a session token

MedDevice Cyber Staff · Aug 11 · 3 min read · Via CISA ICSMA-26-223-01

ICSMA-26-223-01 lists eight CVEs across the Mira Hormone Monitor and its Android companion app, both from Quanovate Tech. The worst of them, CVE-2026-68067 at CVSS v3.1 9.8, sat in the cloud API: the login endpoint accepted any string shaped like a password and handed back an active session token. An email address was the whole attack.

An endpoint that returns a token for any password is not a weak check but its outright absence, treating a filled field as proof of identity behind a login that still looks normal to an ordinary user.

The second critical, CVE-2026-67568 at 9.1, is a set of hard-coded credentials shipped inside the distributed APK, good for read and write access to health profiles from any internet-connected host. The Bluetooth findings sit just underneath. CVE-2026-66875 (8.8) lets an unauthenticated attacker 10 to 30 meters away rebind the monitor, read hormone measurements in cleartext, and track the user passively. CVE-2026-67558 (7.4) exists because the Android app identified devices with a substring match, so a spoofed device captures the session token and injects forged measurements.

A hormone monitor builds an intimate health record, and reach into those profiles exposes measurements a user expects to stay private, while passive tracking leaks a pattern of use on its own.

Weaknesses spanning a cloud API, a shipped app and a Bluetooth link describe a product whose security rests on several separate layers, each maintained by different hands and each its own way in.

Quanovate ran two rounds of remediation. The fixed builds are iOS 3.5.18 and Android 4.5.18, with firmware 01.07.01.53 pushed automatically through the connected app. The research came from the Northeastern University SPQR Lab under HHS ARPA-H funding, credited to Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong.

Six of the eight CVEs live in the app or the cloud API rather than in the device. Manufacturers still scoping security work around the physical product keep rediscovering that most of their auditable attack surface moved to the backend years ago.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the Mira app to iOS 3.5.18 or Android 4.5.18; firmware 01.07.01.53 installs automatically through the connected app. Those builds close the cloud login flaw (CVE-2026-68067) and the hard-coded credentials in the APK (CVE-2026-67568). Rotate any account that was used before the update, since a token could have been issued without a real password.

Update app and firmware. iOS 3.5.18, Android 4.5.18, firmware 01.07.01.53 per ICSMA-26-223-01. Verify the firmware update completed through the app.
Assume pre-fix accounts were reachable. CVE-2026-68067 issued session tokens for any password, so reset credentials for accounts active before the update.
Validate credentials server-side. A login endpoint must verify the password against a stored hash and never return a token on a format check alone.
Keep secrets out of the client. Hard-coded credentials in a distributed APK are extractable by anyone; move all secrets to the server and scope tokens narrowly.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

data_phi

Contributing

net_cloud app_user_accounts net_remote_access app_mobile net_wireless sys_ots_software app_database use_home

EMB3D

PID-331 PID-332 PID-3322 PID-41 PID-4113

Fix the class in your product

The device is fine; the backend decides who gets in. As the maker, verify the password against a stored hash before issuing a token, put every function and object behind a server-side authorization check, and rate-limit. Assume any account reachable before the fix was reached.

Verify credentials server-side. Return a token only on a real hash match, never on a format or shape check.
Authorize every endpoint and object. No route trusts a client assertion of identity or role; scope tokens and make them short-lived.
Throttle and lock out. Add rate limiting and lockout so credentials cannot be brute-forced.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-68067 in the Mira Hormone Monitor?

A weak authentication flaw in Quanovate’s cloud API, rated 9.8 on CVSS v3.1. The login endpoint accepted any format-valid password and returned an active session token, so a user’s email address was enough to take over the account. It is fixed in the updated app and firmware builds.

Which Mira versions are affected by ICSMA-26-223-01?

Mira Monitor firmware 1.7.1.47 and Mira Android app 4.5.15.4. Quanovate Tech released iOS 3.5.18, Android 4.5.18, and firmware 01.07.01.53, and the firmware update installs automatically through the connected app.

Who found the Mira Hormone Monitor vulnerabilities?

Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong of the Northeastern University SPQR Lab, working under HHS ARPA-H funding. CISA published the findings as ICSMA-26-223-01 on August 11, 2026.

← Back to Vulnerabilities