CVE-2026-68067: Mira Hormone Monitor, Mira Android App Weak Authentication
Quanovate Tech Inc. (operating as Mira / Mira Care) · Mira Firmware
Vendor fix available · Affected: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 44% of scored CVEs
DescriptionNVD
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Published
- August 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 14 Aug.
- CVE-2026-68067 (CVSS 9.8): Mira Monitor Flaw Lets Attackers Control User AccountsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.