CVE-2026-66340— Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts
Possible ATT&CK Techniques 1AI
T1110 · Brute ForceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-66340
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts
Source: CVE Program / CVE List V5
Vulnerability Description
The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware | 1.7.1.47 | - | |
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App | 4.5.15.4 | - |
II. Public POCs for CVE-2026-66340
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66340
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-66340 (2)
Same Patch Batch · Quanovate Tech Inc. (operating as Mira / Mira Care) · 2026-08-11 · 8 CVEs total
| CVE-2026-68067 | 9.8 CRITICAL | Mira Hormone Monitor, Mira Android App Weak Authentication |
| CVE-2026-67568 | 9.1 CRITICAL | Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials |
| CVE-2026-66875 | 8.8 HIGH | Mira Hormone Monitor, Mira Android App Missing authentication for critical function |
| CVE-2026-67558 | 7.4 HIGH | Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing |
| CVE-2026-66832 | 6.5 MEDIUM | Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query stri |
| CVE-2026-66098 | 6.5 MEDIUM | Mira Hormone Monitor, Mira Android App Missing authentication for critical function |
| CVE-2026-64934 | 4.3 MEDIUM | Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision |
IV. Related Vulnerabilities
Same product: Mira Firmware
- CVE-2026-66875
Mira Hormone Monitor, Mira Android App Missing authenticatio - CVE-2026-66098
Mira Hormone Monitor, Mira Android App Missing authenticatio - CVE-2026-67558
Mira Hormone Monitor, Mira Android App Authentication bypass - CVE-2026-67568
Mira Hormone Monitor, Mira Android App Use of Hard-coded Cre - CVE-2026-68067
Mira Hormone Monitor, Mira Android App Weak Authentication
Same vendor: Quanovate Tech Inc. (operating as Mira / Mira Care)
- CVE-2026-66875
Mira Hormone Monitor, Mira Android App Missing authenticatio - CVE-2026-66098
Mira Hormone Monitor, Mira Android App Missing authenticatio - CVE-2026-67558
Mira Hormone Monitor, Mira Android App Authentication bypass - CVE-2026-67568
Mira Hormone Monitor, Mira Android App Use of Hard-coded Cre - CVE-2026-68067
Mira Hormone Monitor, Mira Android App Weak Authentication
Same weakness: CWE-307
- CVE-2026-65948
Apache Ranger: UnixAuth lacks brute-force protection - CVE-2026-48084
OpenReception doesn't rate limit passphrase login attempts - CVE-2026-48071
OpenReception's client PIN challenge throttle is keyed by em - CVE-2026-71213
typemill - No Rate Limiting on Login Endpoint Enables Unlimi - CVE-2026-71205
changedetection.io - No Rate Limiting on /login Enables Unli
V. Comments for CVE-2026-66340
No comments yet