Quanovate Tech Inc. (operating as Mira / Mira Care) vulnerabilities
We track 4 vulnerabilities in Quanovate Tech Inc. (operating as Mira / Mira Care) products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 11, 2026.
Latest Quanovate Tech Inc. (operating as Mira / Mira Care) vulnerabilities
- 9.8 Critical severity
Mira Firmware: Weak Authentication
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and acc
- 9.1 Critical severity
Mira Firmware: Use of Hard-coded Credentials
The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.
- 7.4 High severity
Mira Firmware: Authentication Bypass by Spoofing
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker
- 8.8 High severity
Mira Firmware: Missing Authentication for Critical Functionality
In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in clear