Flaws in Mira hormone monitor firmware and cloud systems risk account hijacking

Summary

Multiple high-severity vulnerabilities have been identified in Quanovate Tech Inc. Mira hormone monitoring systems, affecting both the physical hardware firmware and its associated Android companion application. These flaws allow unauthenticated attackers within Bluetooth Low Energy (BLE) range to manipulate device state or extract cleartext health measurements. Simultaneously, critical weaknesses in the Mira cloud API enable remote attackers to hijack user accounts and access reproductive health profiles via the internet.

Technical details

The vulnerabilities span three distinct attack surfaces: the physical hormone monitor hardware, the Android companion app, and the backend cloud infrastructure.

Bluetooth and Hardware Vulnerabilities

Within BLE proximity (approximately 10-30 meters), the Mira firmware is susceptible to several local attacks. An unauthenticated attacker can send a 0x01 write command to force the device into bootloader mode, causing a denial-of-service that disrupts fertility monitoring workflows (CVE-2026-66098).

Furthermore, the firmware allows an attacker to silently rebind the hardware to a different account, extract stored hormone measurements in cleartext, or track users via a static random BLE address that fails to rotate (CVE-2026-66875). The Android companion app (v4.5.15.4) exacerbates this by identifying paired devices through simple substring matches of the BLE advertisement name without cryptographic authentication or identity checks, allowing for the injection of forged measurements into a user's clinical record (CVE-2026-67558).

Cloud and API Vulnerabilities

The remote attack surface is significantly more severe. The Mira cloud API login endpoint contains a critical flaw where it accepts any format-valid string in the password field and returns an active session token for the matching email address (CVE-2026-68067). This allows an attacker to gain full control over user accounts and their hormone records using only a known email address.

This is compounded by two additional issues:

• The distributed Android APK (v4.5.15.4) permits read/write access to reproductive health profiles from internet-connected hosts (CVE-2026-67558).
• The cloud authentication endpoints lack per-account rate limiting, per-IP throttling, or account lockout mechanisms, making them vulnerable to brute-force attacks (CVE-2026-66340).

Affected products and fixed versions

Why this matters for defenders

For users and healthcare providers, these vulnerabilities represent a total loss of data confidentiality and integrity. An attacker can not only steal sensitive reproductive health history but also inject false data into clinical views, which could impact medical decisions. Because the cloud API returns active session tokens regardless of password accuracy, account takeover is trivial once an email address is known.

Defender guidance

Defenders should prioritize securing the cloud-facing infrastructure and verifying device pairing integrity.

• Monitor Cloud Access: Watch for unusual login patterns or high volumes of requests to the Mira cloud authentication endpoints that do not follow standard user behavior.
• Verify Device Identity: Because the Android app relies on unauthenticated BLE advertisement names, ensure that any new device pairing is verified through a secure, out-of-band method if available.
• Account Security: Given the lack of rate limiting and the token leakage flaw, users should be advised to use unique, complex credentials for all health-related services and monitor their account activity closely.