# CVE-2026-67558: Mira Android App BLE device spoofing vulnerability

Source: https://junglewise.ai/threats/cve-2026-67558-mira-android-app-ble-device-spoofing-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67558 · Severity: high · CVSS 7.4 · Published 2026-08-11

The Mira Android app is a mobile companion for a Bluetooth hormone monitoring device used to track fertility. The app fails to cryptographically verify that a Bluetooth device claiming to be a Mira monitor is authentic, relying only on a simple name match. An attacker within Bluetooth range could impersonate the device to intercept session tokens, inject false hormone measurements into patient cloud records, and manipulate clinical data—potentially affecting medical decisions and compromising privacy.

## Quick answers

**Is CVE-2026-67558 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67558 being exploited in the wild.

**How severe is CVE-2026-67558?** High severity, with a CVSS score of 7.4, published 11 August 2026.

**Which products and versions are affected?** Quanovate Tech Inc. (operating as Mira/Mira Care) Mira Android App 4.5.15.4; Quanovate Tech Inc. (operating as Mira/Mira Care) Mira Monitor Firmware 1.7.1.47.

**Is there a fix for CVE-2026-67558?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67558 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-67558?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass (CWE-290) due to inadequate BLE peripheral authentication. The Android app identifies the paired Mira hormone analyzer using only a substring match against the BLE advertisement name, without cryptographic validation, MAC address allowlisting, or bonded-identity verification. An unauthenticated attacker within BLE range (approximately 10–30 meters) can spoof the device identity and capture session tokens in cleartext or inject forged measurements. The attack requires adjacent network proximity but no user authentication, though user interaction is expected in the normal pairing flow. Patches are available in Mira Android App v4.5.18 and firmware v01.07.01.53.

## Affected products

- Quanovate Tech Inc. (operating as Mira/Mira Care) Mira Android App 4.5.15.4
- Quanovate Tech Inc. (operating as Mira/Mira Care) Mira Monitor Firmware 1.7.1.47

## Timeline

- 2026-08-11: disclosed: CISA ICSMA-26-223-01 published

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01)