CVE-2026-68067

Received Received - Intake

Mira Cloud API Authentication Bypass via Email

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: ICS-CERT

Description

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-68067

EUVD

EUVD-2026-56982

Affected Vendors & Products

Vendor	Product	Version / Range
mira	hormone_monitor	*
mira	hormone_monitor_app	to 4.5.15.4 (inc)
mira	hormone_monitor_firmware	to 1.7.1.47 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1390	The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to gain unauthorized access to Mira cloud accounts by exploiting a flaw in the login endpoint. The system accepts any valid string as a password and issues a session token for the email address provided, even if the password is incorrect.

Detection Guidance

This vulnerability allows unauthorized access via the Mira cloud API login endpoint by accepting any valid password string. To detect it, monitor API logs for repeated login attempts with the same email address or unusual session token generation patterns. Check for unauthorized access to hormone records or account settings.

Impact Analysis

An attacker could take control of your Mira cloud account using just your email address. This could expose sensitive data like hormone records and account settings, leading to privacy breaches and potential misuse of your personal information.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by enabling unauthorized access to sensitive health-related data. It undermines confidentiality requirements and could result in legal penalties for non-compliance.

Mitigation Strategies

Immediately disable or restrict access to the Mira cloud API login endpoint until a patch is applied. Review all active session tokens and invalidate any potentially compromised sessions. Implement strict input validation for the password field to reject any non-empty strings.

Hi! I’m here to help you understand CVE-2026-68067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70