[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-mira-fertility-tracker-flaws-let-anyone-take-over-accounts":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},4890,"mira-fertility-tracker-flaws-let-anyone-take-over-accounts","Mira Fertility Tracker Flaws Let Anyone Take Over Accounts","CISA found eight flaws in Mira's hormone monitor and Android app, including a login bug that grants account access with any password.","CISA has flagged eight vulnerabilities in Mira's hormone monitor and its Android app, the kind of bugs that let a stranger read or forge someone's fertility data.\n\nQuanovate Tech's Mira Hormone Monitor firmware (v1.7.1.47) and Mira Android app (v4.5.15.4) carry eight CVEs, the worst rated 9.8 out of 10. One lets anyone log into any account just by supplying any password string alongside a known email address. Another lets an attacker within Bluetooth range, roughly 10 to 30 meters, silently rebind the device to their own account, pull stored hormone readings in cleartext, and track the user through a BLE address that never rotates. The app also identifies its paired device by matching a Bluetooth name only, with no cryptographic check, so a nearby attacker can grab session tokens and inject forged readings into a person's cloud record. Mira has shipped a fix: update the Android app to v4.5.18, which pushes firmware v01.07.01.53 to the device automatically on next connection.\n\nThis isn't abstract risk. The data at stake is reproductive health information, which carries different legal exposure than a leaked password given how fertility and pregnancy records are increasingly scrutinized in some jurisdictions. Pair a login endpoint that accepts any password with no rate limiting on attempts, and an attacker needs nothing but an email address to take over an account.\n\nHealth wearables keep shipping years behind on basic security hygiene. At least the fix here is simple: update the app, and the firmware follows on its own.","[\"security\",\"healthcare\",\"iot\",\"vulnerabilities\"]","2026-08-11T12:00:00.000Z","2026-08-14T05:48:20.234Z","2026-08-14T05:48:32.045Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"publisher-r1","publisher",1,"The fix paragraph suddenly introduces an 'iOS v3.5.18' update even though only the Android app (v4.5.15.4) was ever described as affected, an unexplained inconsistency in the reported facts.","resolved","security",[30,32,33,34],"healthcare","iot","vulnerabilities",[36],{"name":37,"url":38},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-medical-advisories\u002Ficsma-26-223-01",0,{"sections":41},[42,47,50,55,60,65,70,75,80,85,90,95,100,105],{"name":43,"slug":44,"count":45,"latest_published_at":46},"AI","ai",3293,"2026-08-20T04:00:00.000Z",{"name":48,"slug":30,"count":49,"latest_published_at":46},"Security",435,{"name":51,"slug":52,"count":53,"latest_published_at":54},"Policy","policy",210,"2026-08-19T09:32:27.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Hardware","hardware",140,"2026-08-19T18:25:42.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Science","science",90,"2026-08-19T18:41:02.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Startups","startups",47,"2026-08-19T19:13:46.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]