CVE-2026-67558 HIGH

CVE-2026-67558: Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing

Vendor Quanovate Tech Inc. (Operating As Mira / Mira Care)
Product Mira Firmware
Weakness CWE-290
Published August 11, 2026
Last update August 11, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

What the vulnerability does

01Description

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

Key dates

02Disclosure timeline

August 11, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2023-48753 WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability CVE-2026-64875 Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension CVE-2024-25906 WordPress Comments Like Dislike plugin <= 1.2.2 - IP Restriction Bypass Vulnerability vulnerability CVE-2021-34646 Booster for WooCommerce <= 5.4.3 Authentication Bypass CVE-2026-64797 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension