CVE-2026-67558: Mira Android App Auth Bypass Vulnerability

CVE-2026-67558 Overview

CVE-2026-67558 affects the Mira Android companion app version 4.5.15.4, which pairs with the Mira hormone analyzer over Bluetooth Low Energy (BLE). The app identifies the paired peripheral by performing a substring match against the BLE advertisement name. It does not perform cryptographic peripheral authentication, MAC address allowlisting, or bonded-identity verification. An attacker within BLE range can impersonate the analyzer, capture session token data, and inject forged hormone measurements into the victim's cloud record and clinical trend view. The weakness maps to [CWE-290: Authentication Bypass by Spoofing].

Critical Impact
An adjacent attacker can spoof a medical BLE peripheral, harvest live session tokens, and inject fabricated hormone readings into a patient's cloud health record.

Affected Products

Mira Android companion app version 4.5.15.4
Mira hormone analyzer BLE pairing subsystem
Downstream Mira cloud record and clinical trend view

Discovery Timeline

2026-08-11 - CVE-2026-67558 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-67558

Vulnerability Analysis

The Mira companion app treats BLE advertisement name matching as a sufficient identity proof for the paired hormone analyzer. Because BLE advertisement names are broadcast in the clear and can be freely set on any peripheral, any attacker-controlled device can advertise a matching name and satisfy the substring check. Once the app connects to the impostor peripheral, it accepts data from the attacker as if it originated from the legitimate analyzer.

The app also transmits session token information over this unauthenticated link, allowing the attacker to observe live session context. Injected hormone measurements are forwarded to the Mira cloud backend and merged into the patient's longitudinal record, corrupting clinical trend views that clinicians and users rely on.

Root Cause

The root cause is missing peripheral authentication. The application relies on a broadcast identifier that carries no cryptographic binding to a specific device. There is no verification against a bonded BLE identity, no MAC allowlist, and no challenge-response handshake tied to a shared secret established during initial pairing.

Attack Vector

Exploitation requires proximity within BLE range of the victim's Android device and minimal user interaction while the companion app is scanning or connecting. The attacker stands up a rogue BLE peripheral that advertises a name containing the substring the app matches against. When the victim's app connects, the attacker captures session token traffic and then writes crafted GATT characteristic values that the app interprets as legitimate hormone measurements. The forged values propagate to the cloud record through the app's normal upload path.

No verified public exploit code is available. See the CISA ICS Medical Advisory ICSMA-26-223-01 and the CSAF JSON document for the coordinated disclosure details.

Detection Methods for CVE-2026-67558

Indicators of Compromise

Unexpected BLE peripherals advertising names that match or contain the Mira analyzer identifier substring near patient devices.
Hormone measurement records in the Mira cloud that deviate sharply from the patient's established baseline or arrive outside normal usage windows.
Duplicate or rapid-succession measurement uploads that do not correspond to a physical test performed by the user.

Detection Strategies

Perform BLE spectrum sweeps in clinical or home environments to identify duplicate advertisement names originating from unknown MAC addresses.
Compare uploaded measurement metadata (timestamps, sequence numbers, device identifiers) against expected analyzer telemetry to flag inconsistencies.
Monitor Android device logs for repeated BLE connect and disconnect events involving the Mira service UUID.

Monitoring Recommendations

Enable server-side anomaly detection on the Mira cloud account for out-of-range hormone values and non-physiological deltas between readings.
Alert users and clinicians when measurements are received from a peripheral whose bonded identity differs from the previously observed device.
Review paired BLE device lists on Android periodically and remove unrecognized entries.

How to Mitigate CVE-2026-67558

Immediate Actions Required

Only operate the Mira companion app in trusted physical environments where adjacent BLE attackers are unlikely to be present.
Disable Bluetooth on the Android device when the app is not actively in use to reduce the exposure window.
Verify recent measurements in the Mira cloud record against physical test logs and report anomalies to the vendor and clinician.

Patch Information

Refer to the CISA ICS Medical Advisory ICSMA-26-223-01 for vendor-supplied remediation guidance and any updated app versions superseding 4.5.15.4. Apply vendor updates as soon as they are published through the Google Play Store.

Workarounds

Restrict use of the companion app to isolated locations where no untrusted BLE devices are broadcasting.
Remove the Mira analyzer from the Android Bluetooth paired-device list and re-pair only in a controlled setting to reduce the likelihood of connecting to an impostor.
Cross-check clinical decisions against measurements taken directly from the analyzer display rather than relying solely on the cloud trend view.

bash

# Configuration example
# Reduce BLE exposure window on Android when the app is idle
adb shell settings put global bluetooth_on 0