Mira’s cloud login accepted any password and returned a session token

MedDevice Cyber Staff · 5 days ago · 3 min read · Via CISA ICSMA-26-223-01

Samantha Gades / Unsplash

ICSMA-26-223-01 lists eight CVEs across the Mira Hormone Monitor and its Android companion app, both from Quanovate Tech. The worst of them, CVE-2026-68067 at CVSS v3.1 9.8, sat in the cloud API: the login endpoint accepted any string shaped like a password and handed back an active session token. An email address was the whole attack.

The second critical, CVE-2026-67568 at 9.1, is a set of hard-coded credentials shipped inside the distributed APK, good for read and write access to health profiles from any internet-connected host. The Bluetooth findings sit just underneath. CVE-2026-66875 (8.8) lets an unauthenticated attacker 10 to 30 meters away rebind the monitor, read hormone measurements in cleartext, and track the user passively. CVE-2026-67558 (7.4) exists because the Android app identified devices with a substring match, so a spoofed device captures the session token and injects forged measurements.

Quanovate ran two rounds of remediation. The fixed builds are iOS 3.5.18 and Android 4.5.18, with firmware 01.07.01.53 pushed automatically through the connected app. The research came from the Northeastern University SPQR Lab under HHS ARPA-H funding, credited to Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong.

Six of the eight CVEs live in the app or the cloud API rather than in the device. Manufacturers still scoping security work around the physical product keep rediscovering that most of their auditable attack surface moved to the backend years ago.

Remediation Desk

Update the Mira app to iOS 3.5.18 or Android 4.5.18; firmware 01.07.01.53 installs automatically through the connected app. Those builds close the cloud login flaw (CVE-2026-68067) and the hard-coded credentials in the APK (CVE-2026-67568). Rotate any account that was used before the update, since a token could have been issued without a real password.

Update app and firmware. iOS 3.5.18, Android 4.5.18, firmware 01.07.01.53 per ICSMA-26-223-01. Verify the firmware update completed through the app.
Assume pre-fix accounts were reachable. CVE-2026-68067 issued session tokens for any password, so reset credentials for accounts active before the update.
Validate credentials server-side. A login endpoint must verify the password against a stored hash and never return a token on a format check alone.
Keep secrets out of the client. Hard-coded credentials in a distributed APK are extractable by anyone; move all secrets to the server and scope tokens narrowly.

Questions & Answers

What is CVE-2026-68067 in the Mira Hormone Monitor?

A weak authentication flaw in Quanovate’s cloud API, rated 9.8 on CVSS v3.1. The login endpoint accepted any format-valid password and returned an active session token, so a user’s email address was enough to take over the account. It is fixed in the updated app and firmware builds.

Which Mira versions are affected by ICSMA-26-223-01?

Mira Monitor firmware 1.7.1.47 and Mira Android app 4.5.15.4. Quanovate Tech released iOS 3.5.18, Android 4.5.18, and firmware 01.07.01.53, and the firmware update installs automatically through the connected app.

Who found the Mira Hormone Monitor vulnerabilities?

Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong of the Northeastern University SPQR Lab, working under HHS ARPA-H funding. CISA published the findings as ICSMA-26-223-01 on August 11, 2026.

← Back to Vulnerabilities