The 9.8 CVSS rating and 0.00284 EPSS score are in tension, and resolving that tension requires examining what actually constrains attacker reach in practice. The vulnerability is straightforward: Mira's login endpoint accepts any password and requires only a valid email. But the EPSS prediction of negligible automated exploitation is plausible if email addresses can't be obtained at scale. Your first investigative priority should be determining whether Mira's API leaks account existence through differential responses — timing differences, different error messages for valid versus invalid emails, or other API calls that confirm account presence. If enumeration is easy, the EPSS is underweighting this and the CVSS is appropriate. If emails are obscure or require prior compromise to discover, the technical flaw remains trivially exploitable against targeted victims but doesn't support automated mass exploitation — which explains the EPSS reading.
The "format-valid" question matters for understanding the root cause and predicting patch behavior. If any non-empty string passes validation, this is likely a developer who trusted client-side checks that were never enforced server-side — an integration failure. If there's a format check being bypassed, that's a logic error in the validation routine. These have different patch patterns and different implications for whether similar flaws exist elsewhere in the codebase.
The absence of mentioned compensating controls (MFA, rate limiting, lockout policies) in the vulnerability description is itself informative — assume they don't exist or are ineffective until proven otherwise. This compounds the risk during targeted attacks even if mass exploitation is impractical.
The HIPAA dimension changes the impact calculus. Hormone records are protected health information with individual harm potential, regulatory exposure under breach notification thresholds, and cascading liability. EPSS weights technical exploitability over impact scope, so a flaw with narrow reach but catastrophic PHI exposure will systematically score low in automated exploitation models. For defenders, the question isn't just whether attackers can reach the login endpoint — it's what detonates after successful authentication: access to an interconnected healthcare ecosystem with clinical systems, provider dashboards, and pharmacy integrations.
Concrete priorities: First, test the login endpoint and related APIs for account enumeration vectors. Second, audit for other forgotten authentication logic — if the password check atrophied this badly, other access control sediment likely exists. Third, treat this as a HIPAA incident regardless of current exploitation activity, because the disclosure event itself starts the regulatory exposure clock.