A fertility tracker that women use to measure their own hormone levels has been shipping with a login system that barely checks passwords. CISA published eight vulnerabilities in the Mira hormone monitor and its companion app on August 11, and the most serious of them lets anyone who knows a user's email address obtain a live session token for that account and read, alter or delete the reproductive health records inside it.
The device is made by Quanovate Tech Inc, which trades as Mira, is headquartered in the United States and sells worldwide. The flaws were reported to the vendor by Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova and En Mong of the SPQR Lab at Northeastern University, and are set out in CISA's advisory. Fixes are already out. CISA says it has no reports of public exploitation.
What is affected
Mira Monitor firmware 1.7.1.47 and the Mira Android app 4.5.15.4. Users should update the app to iOS v3.5.18 or Android v4.5.18; firmware v01.07.01.53 then installs through the app the next time the device connects.
The eight issues, in order of severity:
- CVE-2026-68067 (CVSS 9.8) The cloud login endpoint accepts any correctly formatted string in the password field and returns a live session token for whichever account matches the email address supplied.
- CVE-2026-67568 (CVSS 9.1) The shipped Android app allows read and write access to reproductive health profiles from internet-connected hosts, which CISA says could result in forgery, deletion or destruction of health information. It is filed under hard-coded credentials.
- CVE-2026-66875 (CVSS 8.8) An unauthenticated attacker within Bluetooth Low Energy range, roughly 10 to 30 meters, can silently rebind the device to an account they control, pull stored hormone measurements in cleartext, crash the device with malformed command codes, and track the user passively because the device's BLE address never rotates.
- CVE-2026-67558 (CVSS 7.4) The Android app decides it has found the right analyzer by matching part of the Bluetooth advertisement name, with no cryptographic check of the peripheral. That allows an attacker to capture a live session token and inject fabricated hormone readings into the victim's cloud record and clinical trend view.
- CVE-2026-66098 (CVSS 6.5) Any nearby Bluetooth device can write a single value that reboots the monitor into bootloader mode, interrupting ovulation and fertility tracking.
- CVE-2026-66832 (CVSS 6.5) When the app opens in-app web content such as shop redirects, it appends the user's live session token to the URL and puts a persistent identifier in the browser user-agent string, handing both to third-party sites, referrer logs and any JavaScript running in that view.
- CVE-2026-66340 (CVSS 5.3) The cloud authentication endpoints enforce no rate limiting, throttling or lockout, so accounts can be brute-forced.
- CVE-2026-64934 (CVSS 4.3) The cloud API trusts whatever firmware version the app reports, so a user could suppress their own update prompts and distort the vendor's view of how much of its fleet is patched.
Why it matters
Fertility and cycle data is among the most sensitive categories of personal information there is, and the integrity side is as serious as the confidentiality side. Several of these flaws allow an attacker to write false readings into a record that the user, and potentially a clinician, will read as a real trend. Health gadgets keep landing in CISA's medical advisory stream for the same reasons: a DNA analyzer flaw last week let attackers alter genetic test results, and a shared Bluetooth key in a car alarm let attackers unlock and immobilize vehicles.
A second device, and an unresponsive vendor
CISA published a second medical advisory the same day, for the Pulsetto Vagus Nerve Stimulator. It covers CVE-2026-18844 at CVSS 8.1: the firmware accepts several undisclosed commands over Bluetooth Low Energy, without authentication or encryption, that the companion app never sends but the device processes anyway whenever it is powered on. CISA says successful exploitation could let an attacker disable electrical safety mechanisms or change stimulation output settings. It is not remotely exploitable and there are no reports of public exploitation. The issue was reported by A.C. Buglione. There is no patch: CISA states that Pulsetto has not responded to its requests to work on a fix, and points users to the vendor directly.
What you should do
Mira users should update the app now and let the firmware update apply. Anyone who has used the device should treat the account password as exposed and change it, and be aware that historical readings could have been altered. Pulsetto owners have no fix available and should keep the device powered off when not in use, given that the undocumented commands are only processed while it is on.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.