CVE-2026-67558 — Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptograph…
Published: 2026-08-11 · CVSS: 8.2 · CVSS 4.0
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7