A critical authentication bypass vulnerability in the Mira cloud API allows unauthenticated attackers to gain full control over user cloud accounts.

This is an authentication bypass vulnerability (CWE-1390) affecting the cloud API login endpoint. The system accepts any format-valid password string, granting the attacker a valid session token for the targeted account without requiring actual credentials.

Successful exploitation grants an attacker full access to a user's cloud account. This leads to the exposure of sensitive hormone records and personal account settings, resulting in significant privacy violations and potential regulatory non-compliance. With a CVSS score of 9.8, the ease of exploitation and the severity of the data impact necessitate immediate remediation.

Immediate Action: Update the Mira Android app to version 4.5.18 and the iOS app to version 3.5.18. Once the app is updated, the device firmware will automatically update to version 01.07.01.53 upon connection.

Proactive Monitoring: Review API access logs for unusual login patterns or a high volume of successful sessions associated with suspicious IP addresses.

Compensating Controls: Ensure that multi-factor authentication is enabled where supported, and restrict API access to known-good IP ranges if the operational environment permits.

Public Exploit Available: Unknown.

This vulnerability represents a critical risk to user data privacy and system integrity. Because the flaw exists within the cloud API authentication logic, it is highly susceptible to automated exploitation. All users must prioritize the update of their mobile applications to the versions specified above to ensure the underlying firmware is patched correctly.