Security flaws in the Mira Hormone Monitor and its Android companion app could let attackers access reproductive health information, alter records, disrupt monitoring, expose session tokens and take control of user accounts, the CISA advisory says. The affected products are Mira Monitor firmware version 1.7.1.47 and Mira Android App version 4.5.15.4. CISA lists eight vulnerabilities across the device, app and cloud services, with the advisory assigning the vendor equipment vulnerability set a CVSS v3 score of 9.8.
The most severe listed issue is CVE-2026-68067, a weakness in the Mira cloud API’s login process. The endpoint accepts any format-valid string in the password field and returns an active session token for the account associated with a supplied email address. An attacker could use that behavior to control cloud accounts, access hormone records and change account settings, according to CISA. The advisory assigns the flaw a CVSS v3 score of 9.8 and classifies it as critical.
Another critical issue, CVE-2026-67568, affects the distributed Android application. CISA says an attacker can obtain read and write access to reproductive health profiles from internet-connected hosts. That access could enable the forgery, deletion or destruction of health information. The vulnerability carries a CVSS v3 score of 9.1 and is attributed to the use of hard-coded credentials.
The device also has a Bluetooth Low Energy exposure. CVE-2026-66875 allows a remote, unauthenticated attacker within BLE range, described in the advisory as approximately 10 to 30 meters, to silently rebind the monitor to an attacker-controlled account. The attacker could extract stored hormone measurements in cleartext, trigger a denial-of-service condition with malformed or undocumented command opcodes and passively track the user through a static random BLE address that never rotates. CISA gives this issue a CVSS v3 score of 8.8.
The companion app’s device-pairing process creates a separate path to data manipulation. In version 4.5.15.4, the app identifies a paired analyzer through a substring match against the BLE advertisement name. The advisory says the process lacks cryptographic peripheral authentication, a MAC allowlist and a bonded-identity check. An attacker could capture live session-token information and inject forged hormone measurements into a victim’s cloud record and clinical trend view. CISA rates CVE-2026-67558 high, with a CVSS v3 score of 7.4.
A further firmware flaw, CVE-2026-66098, allows any BLE central to send an unauthenticated 0x01 write. That command causes the monitor to reboot into bootloader mode, potentially disrupting ovulation tracking and fertility-monitoring workflows or creating a denial-of-service condition. The advisory rates the issue medium under CVSS v3, with a score of 6.5.
The remaining listed weaknesses affect cloud authentication and device-management logic. Mira’s cloud authentication endpoints do not enforce per-account rate limits, per-IP throttling or account lockout after repeated failed login attempts, allowing brute-force attempts against user accounts. Separately, the cloud API accepts the firmware version reported by the companion app as authoritative without independently attesting the version from the device. An authenticated attacker could submit an arbitrary version string for that person’s device, evade vulnerable-fleet analytics, suppress security-update prompts and misrepresent patch-adoption metrics, CISA says.
CISA identifies Quanovate Tech Inc., operating as Mira or Mira Care, as the vendor and places the products in the Healthcare and Public Health critical-infrastructure sector. The advisory says the products are deployed worldwide. Users should update the Mira app to iOS version 3.5.18 or Android version 4.5.18. When the monitor is connected through the app, firmware version 01.07.01.53 is updated through that process. The advisory says no additional action is required after the update.