The Mira Android companion app v4.5.15.4 for the Mira hormone analyzer performs device pairing based solely on a substring match of the BLE advertisement name. It lacks cryptographic peripheral authentication, MAC address allowlisting, or bonded-identity verification. This design flaw (CWE-290: Authentication Bypass) enables an attacker to intercept live session tokens and inject falsified hormone measurement data into the victim's cloud account and clinical trend data, potentially compromising the integrity of medical records.

An attacker can manipulate the victim's hormone measurement data stored in the cloud by injecting forged data, which could lead to incorrect clinical interpretations or decisions based on compromised data integrity. The vulnerability does not require privileges or user interaction beyond pairing and has a high impact on data confidentiality and integrity.

No official patch or remediation level has been published yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about pairing the Mira app in untrusted environments and monitor for updates from the vendor.