Mira Android App
Approved changes feed: RSS · Atom
cpe:2.3:a:quanovate_tech_inc._(operating_as_mira_/_mira_care):mira_android_app:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Quanovate Tech Inc. (Operating As Mira / Mira Care) (f82c271a-92cd-55f2-92b2-0c9259dad8ce) |
|---|---|
| Product | Mira Android App (813faacc-00b0-5607-a84e-b1caf074dda1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-68067 |
vulnerable | 2026-09-16 04:33:59.365471 |
Mira Hormone Monitor, Mira Android App Weak Authentication
CRITICAL (9.8)
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
Published: 2026-08-11T21:23:05.640Z
Updated: 2026-08-12T12:53:26.573Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64934 |
vulnerable | 2026-09-16 04:33:10.783551 |
Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
MEDIUM (4.3)
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.
Published: 2026-08-11T21:15:13.291Z
Updated: 2026-08-12T12:57:16.516Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-67558 |
vulnerable | 2026-09-16 04:33:05.876965 |
Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing
HIGH (7.4)
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
Published: 2026-08-11T21:27:03.214Z
Updated: 2026-08-12T15:19:42.642Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-67568 |
vulnerable | 2026-09-16 04:33:05.642554 |
Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials
CRITICAL (9.1)
The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.
Published: 2026-08-11T21:25:10.814Z
Updated: 2026-08-12T12:52:01.874Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66832 |
vulnerable | 2026-09-16 04:32:55.314566 |
Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
MEDIUM (6.5)
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.
Published: 2026-08-11T20:49:56.584Z
Updated: 2026-08-12T12:57:47.450Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66875 |
vulnerable | 2026-09-16 04:32:55.308043 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66340 |
vulnerable | 2026-09-16 04:32:55.215542 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66098 |
vulnerable | 2026-09-16 04:32:54.966490 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.