# CVE-2026-66340: Mira cloud authentication brute-force vulnerability

Source: https://junglewise.ai/threats/cve-2026-66340-mira-cloud-authentication-brute-force-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66340 · Severity: medium · CVSS 5.3 · Published 2026-08-11

Mira's cloud authentication system does not implement rate limiting, IP throttling, or account lockout protections. An attacker can repeatedly submit login attempts without restriction, enabling brute-force attacks to gain unauthorized access to user accounts containing sensitive health and fertility tracking data.

Technologies: [Quanovate Tech Inc. Mira Android App](https://junglewise.ai/threats/technologies/mira-android-app), [Quanovate Tech Inc. Mira Monitor Firmware](https://junglewise.ai/threats/technologies/mira-monitor-firmware). Vendors: [Quanovate Tech Inc.](https://junglewise.ai/threats/vendors/quanovate-tech-inc).

## Quick answers

**Is CVE-2026-66340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66340 being exploited in the wild.

**How severe is CVE-2026-66340?** Medium severity, with a CVSS score of 5.3, published 11 August 2026.

**Which products and versions are affected?** Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.

**Is there a fix for CVE-2026-66340?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66340 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-66340?** Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper restriction of excessive authentication attempts (CWE-640) in Mira's cloud authentication endpoints. The authentication service lacks per-account rate limiting, per-IP request throttling, and account lockout mechanisms following repeated failed login attempts. An attacker with network access can conduct brute-force attacks against user accounts without triggering any protective countermeasures. No authentication is required to initiate login attempts. Patches are available: Mira Monitor Firmware v01.07.01.53 and Mira Android App v4.5.18.

## Affected products

- Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47
- Quanovate Tech Inc. Mira Android App 4.5.15.4

## Timeline

- 2026-08-11: disclosed

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01)

## Related threats

- [Mira Cloud API authentication bypass in login endpoint](https://junglewise.ai/threats/cve-2026-68067-mira-cloud-api-authentication-bypass-in-login-endpoint)
- [Mira Android App data access vulnerability](https://junglewise.ai/threats/cve-2026-67568-mira-android-app-data-access-vulnerability)
- [Mira Hormone Monitor authentication bypass via Bluetooth](https://junglewise.ai/threats/cve-2026-66875-mira-hormone-monitor-authentication-bypass-via-bluetooth)
- [Mira cloud API arbitrary firmware version misrepresentation](https://junglewise.ai/threats/cve-2026-64934-mira-cloud-api-arbitrary-firmware-version-misrepresentation)