CVE-2026-68067

CriticalCVSS 9.8

Published: 11/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

Risk Assessment

The vulnerability allows unauthorized access to sensitive health data and account takeover, potentially compromising user privacy.

Recommendation

Immediately fix password validation in the Mira API, enforce strong authentication, and inform users about the risk.

Other vulnerabilities in Mira cloud API

CVE-2026-64934Medium
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS