CVE-2026-68067 Mira Hormone Monitor, Mira Android App Weak Authentication
Attackers can bypass authentication by submitting any valid string as a password to gain account access and view hormone data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-68067?
CVE-2026-68067 is a critical authentication bypass vulnerability in Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
Weakness: CWE-1390
Which versions are affected by CVE-2026-68067?
How do I fix CVE-2026-68067?
No fix has been published for CVE-2026-68067 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-68067 being exploited?
There is no known exploitation of CVE-2026-68067 in the wild and no public exploit code.
Sources
Also known as GHSA-g9jf-c3gx-prx3.