The flaw resides in the Mira cloud API login; any properly formed string is accepted as a password, and the endpoint returns an active session token for the account corresponding to the supplied email. This weak authentication mechanism allows an attacker to obtain legitimate session credentials for any user simply by guessing or selecting an email address. The consequence is unauthorized access to sensitive hormone records and account settings, a serious breach of confidentiality. The weakness is classified as CWE-1390, reflecting improper handling of input validation for authentication.

The vulnerability affects the Mira Android App and associated Mira Firmware delivered by Quanovate Tech Inc. Users running older versions of the Android app before v4.5.18 (and corresponding iOS app before v3.5.18) are impacted. Earlier firmware builds prior to v01.07.01.53 also inherit the issue, as they are updated through the app when the device is connected. Updating to the latest app or firmware releases resolves the problem.

The CVSS score of 9.3 denotes critical impact, while the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only remote access to the exposed API endpoint; no local privileges or physical access are needed. An attacker can remotely craft a password payload, submit it alongside any target email, and immediately receive a valid session token, enabling full access to the victim's hormone data and settings.