CVE-2026-68067
CriticalCVSS 9.8Summary
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
Risk Assessment
The vulnerability allows unauthorized access to sensitive health data and account takeover, potentially compromising user privacy.
Recommendation
Immediately fix password validation in the Mira API, enforce strong authentication, and inform users about the risk.
Original NVD description (English source)
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.