CVE-2026-68067
Critical · 9.8CVSS
9.8
EPSS
—
Published
Aug 11, 2026
CISA due date
—
The record
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73819 The affected Ebyte product's vendor configuration utility permits access to… CWE-1390
- CVE-2026-44476 Doorkeeper is an OAuth 2 provider for Ruby on Rails. CWE-1390
- CVE-2026-65098 NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow… CWE-1390
- CVE-2026-59135 Weak authentication in Microsoft Windows Search Component allows an authorized attacker… CWE-1390
- CVE-2026-55040 Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to… CWE-1390
- CVE-2026-0274 An improper validation of credentials vulnerability in the CommvaultSecurityIQ… CWE-1390
- CVE-2026-6274 Improper Authentication, Missing authentication for critical function, Weak… CWE-1390
- CVE-2026-44237 FreePBX is an open source IP PBX. CWE-1390