Is CVE-2026-67558 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-67558?

CVE-2026-67558 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-67558

Description

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.