The CVE-2026-68067 vulnerability affects the Mira cloud API, specifically its login endpoint, which allows an attacker to obtain a live active session token for any account by providing a valid email address and any format-valid string in the password field. This critical vulnerability (CVSS Score: 9.3) has significant implications for organizations using the Mira cloud API, particularly those in the heal [truncated]
CRITICALQuanovate Tech Inc. (operating as Mira / Mira Care)CVE published 2026-08-11
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T22:18:54.877Z and has not been modified since then. The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet-connected hosts, which could result in forgery, deletion, or destruction of health information. This vulnerability has [truncated]
HIGHQuanovate Tech Inc. (operating as Mira / Mira Care)CVE published 2026-08-11
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
MEDIUMQuanovate Tech Inc. (operating as Mira / Mira Care)CVE published 2026-08-11
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T22:18:41.897Z and has not been modified since then. The NVD entry is currently Deferred. The Mira cloud API's acceptance of firmware version reports from the companion app without independent verification from the device allows authenticated attackers to submit arbitrary firmware version strings. [truncated]
MEDIUMQuanovate Tech Inc. (operating as Mira / Mira Care)CVE published 2026-08-11
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T21:17:49.713Z and has not been modified since then. The Mira Android app vulnerability (CVE-2026-66832) involves the exposure of user session tokens and identifiers to third-party web properties via in-app WebView content. When the app opens WebView content, such as shop redirect flows, it append [truncated]
