Is CVE-2026-68067 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68067 being exploited in the wild.

How severe is CVE-2026-68067?

Critical severity, with a CVSS score of 9.8, published 11 August 2026.

Which products and versions are affected?

Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.

Is there a fix for CVE-2026-68067?

A patch was published on 2026-08-11: Patches available: Mira Monitor Firmware v01.07.01.53, iOS v3.5.18, Android v4.5.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-68067?

Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68067: Mira Cloud API authentication bypass in login endpoint

CVE-2026-68067 · Severity: critical · CVSS 9.8 · Published 2026-08-11

The Mira cloud API, which manages hormone monitoring data and fertility tracking for thousands of users worldwide, contains a critical authentication flaw in its login endpoint. The flaw allows attackers to gain unauthorized access to any user account by simply providing a valid email address and any password string, bypassing all password verification. Once logged in, attackers can view private health records, modify fertility and hormone data, and change account settings.

Technologies: Quanovate Tech Inc. Mira Android App, Quanovate Tech Inc. Mira Monitor Firmware. Vendors: Quanovate Tech Inc..

Quick answers

Is CVE-2026-68067 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68067 being exploited in the wild.
How severe is CVE-2026-68067?: Critical severity, with a CVSS score of 9.8, published 11 August 2026.
Which products and versions are affected?: Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.
Is there a fix for CVE-2026-68067?: A patch was published on 2026-08-11: Patches available: Mira Monitor Firmware v01.07.01.53, iOS v3.5.18, Android v4.5.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-68067?: Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in the Mira cloud API login endpoint. The vulnerable component accepts any format-valid string as a password and returns a valid session token for the account associated with the supplied email address, completely bypassing password verification. This is a missing authentication control (CWE-306) that allows unauthenticated attackers on the network to assume control of any account. The attack requires only knowledge of a valid email address and network access to the cloud API; no user interaction or prior authentication is needed. An attacker can immediately obtain a live active session token and use it to access and modify sensitive health data. Patches are available in Mira Monitor Firmware v01.07.01.53 and Mira Android App v4.5.18 (iOS) / v4.5.18 (Android).

Affected products

Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47
Quanovate Tech Inc. Mira Android App 4.5.15.4

Timeline

2026-08-11: disclosed: CISA advisory ICSMA-26-223-01 published
2026-08-11: patched: Patches available: Mira Monitor Firmware v01.07.01.53, iOS v3.5.18, Android v4.5.18

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.