Which versions of Mira are affected by CVE-2026-67568?

Mira Android app v4.5.15.4 contains hard-coded credentials allowing unauthenticated network attackers to read, modify, and delete users' reproductive health records without authentication.

How to fix or mitigate CVE-2026-67568?

Within 24 hours: issue emergency user advisory recommending immediate discontinuation of Mira app v4.5.15.4; pull backend access logs to identify affected user accounts and exposed records. Within 7 days: engage Mira vendor for emergency patch timeline and coordinate with legal and compliance teams to assess HIPAA breach notification requirements (potential 60-day notification deadline); implement emergency controls to restrict API access if app operations must continue. Within 30 days: upgrade all users to patched version once available from vendor, complete breach assessment and regulatory notifications, and audit all systems with access to sensitive health data for similar credential exposure.

Mira CVE-2026-67568

Q: What is the CVSS score of CVE-2026-67568?

CVE-2026-67568 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-57005 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-08-11 ics-cert@hq.dhs.gov

GHSA-768p-7gf7-2686

Authentication Bypass Google

9.3

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Hard-coded credentials give network, no-auth, no-interaction access (AV:N/AC:L/PR:N/UI:N) with full read (C:H) and write/forge (I:H) over health profiles; data destruction is treated as an integrity impact so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:39 vuln.today

CVE Published

Aug 11, 2026 - 22:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

AnalysisAI

Unauthenticated read/write access to reproductive-health profiles in the Mira Android app (v4.5.15.4) lets internet-based attackers view, forge, delete, or destroy stored fertility and reproductive health records. The flaw stems from hard-coded credentials (CWE-798) and is reachable over the network with no authentication or user interaction, carrying a CVSS 4.0 base score of 9.3. It was reported through CISA/DHS ICS-CERT as medical advisory ICSMA-26-223-01; no public exploit code or active-exploitation listing has been identified at time of analysis.

Technical ContextAI

Mira is a consumer reproductive/fertility tracking platform whose Android client (APK v4.5.15.4) synchronizes user health profiles with an internet-facing backend. The root cause is classified as CWE-798 (Use of Hard-coded Credentials), meaning authentication material is embedded in the distributed application or its API layer rather than being unique per user or protected server-side. Because those credentials are static and shipped with every copy of the APK, any party who extracts or replays them can authenticate to the backend as a trusted client and reach reproductive-health profile data directly. The 'Authentication Bypass' and 'Google' (Android/Play) tags, together with the CWE, indicate the trust boundary between client and cloud service is effectively defeated at the credential layer.

RemediationAI

No vendor-released patch version is present in the provided data, so consult CISA advisory ICSMA-26-223-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01) and the associated CSAF file for the vendor's fixed build and upgrade to it as soon as it is published; because the root cause is hard-coded credentials, a client update alone is insufficient unless the vendor also rotates/invalidates the embedded credentials server-side. As compensating controls until a fix is deployed, restrict or monitor the app's backend API endpoints for anomalous access patterns, and where feasible have the vendor apply per-user authentication tokens and revoke the static credential - the trade-off is that revoking the shared credential will break older app versions still relying on it, forcing all users to update. End users concerned about exposure can minimize the reproductive-health data stored in their profile, accepting reduced app functionality as the side effect.