CVE-2026-68067: critical vulnerability in Quanovate Tech Inc. (operating as Mira / Mira…
Mira Hormone Monitor, Mira Android App Weak Authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.5%
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Quanovate Tech Inc. (operating as Mira / Mira Care) · Mira Android AppQuanovate Tech Inc. (operating as Mira / Mira Care) · Mira FirmwareRelated CVEs — Quanovate Tech Inc. (operating as Mira / Mira…
In the same product, most dangerous first.
CVE-2026-67568CRITICALMira Hormone Monitor, Mira Android App Use of Hard-coded CredentialsEPSS 0.4%CVE-2026-66875HIGHMira Hormone Monitor, Mira Android App Missing authentication for critical functionEPSS 0.4%CVE-2026-66340MEDIUMMira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attemptsEPSS 0.4%CVE-2026-66832MEDIUMMira Hormone Monitor, Mira Android App Use of GET request method with sensitive query stringsEPSS 0.4%CVE-2026-66098HIGHMira Hormone Monitor, Mira Android App Missing authentication for critical functionEPSS 0.3%CVE-2026-64934MEDIUMMira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decisionEPSS 0.3%