CVE-2026-67558

Name of the Vulnerable Software and Affected Versions Mira Android companion app version 4.5.15.4

Description The application identifies the paired Mira hormone analyzer using only a substring match against the BLE (Bluetooth Low Energy) advertisement name. This process lacks cryptographic peripheral authentication, MAC allowlist, or bonded-identity checks. Consequently, an attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.