CVE-2026-68067CWE-1390

CVE-2026-68067

Critical · published August 12, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-1390 · Weak Authentication
Published
2026-08-12T02:18Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json · [email protected]https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 · [email protected]
EPSS history
Timeline
  • 11 AUG 21:23Z
    Mira Hormone Monitor, Mira Android App Weak Authentication
    cvelistv5