# CVE-2026-67568: Mira Android App data access vulnerability

Source: https://junglewise.ai/threats/cve-2026-67568-mira-android-app-data-access-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67568 · Severity: critical · CVSS 9.1 · Published 2026-08-11

Mira is a fertility and hormone tracking application used by consumers to monitor reproductive health through a companion wearable device. A critical vulnerability in the Android app version 4.5.15.4 allows attackers on a local network to read and modify sensitive health profile data without authentication, enabling attackers to alter medical records, impersonate users, or disrupt fertility tracking.

Technologies: [Quanovate Tech Inc. Mira Android App](https://junglewise.ai/threats/technologies/mira-android-app), [Quanovate Tech Inc. Mira Monitor Firmware](https://junglewise.ai/threats/technologies/mira-monitor-firmware). Vendors: [Quanovate Tech Inc.](https://junglewise.ai/threats/vendors/quanovate-tech-inc).

## Quick answers

**Is CVE-2026-67568 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67568 being exploited in the wild.

**How severe is CVE-2026-67568?** Critical severity, with a CVSS score of 9.1, published 11 August 2026.

**Which products and versions are affected?** Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.

**Is there a fix for CVE-2026-67568?** A patch was published on 2026-08-11: Android app v4.5.18, Firmware v01.07.01.53 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67568 attacked?** It is attacked from the adjacent network, in a web application.

**Am I affected by CVE-2026-67568?** Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Mira Android app v4.5.15.4 relies on insecure device pairing mechanisms, using only substring matching of BLE advertisement names without cryptographic authentication, MAC allowlists, or bonded-identity verification. This authentication bypass allows attackers within Bluetooth range (approximately 10–30 meters) to intercept session tokens and inject forged hormone measurements. An attacker can read/write reproductive health profiles from internet-connected hosts without credentials, leading to unauthorized disclosure, modification, and deletion of sensitive health information. Affected firmware version 1.7.1.47 compounds the issue by accepting unauthenticated BLE commands. Patches are available: Android v4.5.18 and Firmware v01.07.01.53.

## Affected products

- Quanovate Tech Inc. Mira Android App 4.5.15.4
- Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47

## Timeline

- 2026-08-11: disclosed
- 2026-08-11: patched: Android app v4.5.18, Firmware v01.07.01.53

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01)

## Related threats

- [Mira Cloud API authentication bypass in login endpoint](https://junglewise.ai/threats/cve-2026-68067-mira-cloud-api-authentication-bypass-in-login-endpoint)
- [Mira Hormone Monitor authentication bypass via Bluetooth](https://junglewise.ai/threats/cve-2026-66875-mira-hormone-monitor-authentication-bypass-via-bluetooth)
- [Mira cloud authentication brute-force vulnerability](https://junglewise.ai/threats/cve-2026-66340-mira-cloud-authentication-brute-force-vulnerability)
- [Mira cloud API arbitrary firmware version misrepresentation](https://junglewise.ai/threats/cve-2026-64934-mira-cloud-api-arbitrary-firmware-version-misrepresentation)