CVE-2026-66875

Name of the Vulnerable Software and Affected Versions Mira hormone monitor device firmware version 1.7.1.47 build 01070147

Description A remote unauthenticated attacker within Bluetooth Low Energy (BLE) range (approximately 10–30 meters) can silently rebind the device to an account under their control. This allows the attacker to extract stored hormone measurements in cleartext and passively track the user because the device uses a static random BLE address that does not rotate. Additionally, the attacker can trigger a denial-of-service by sending malformed or undocumented command opcodes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.