Mendi

Published
March 2026
Updated
August 2026
Vertex-view diagram of the 10–20 system showing the Mendi fNIRS montage: an LED source at Fpz and photodetectors at Fp1 and Fp2, forming two measurement channels over the left and right prefrontal cortex.
Brodmann Area 10 (BA10)

Overview

Mendi is a consumer neurofeedback headset that measures prefrontal blood-oxygenation with functional near-infrared spectroscopy (fNIRS) and streams it to a companion application over Bluetooth Low Energy (BLE). It senses through two channels using near-infrared light at 660 and 805 nm. This report documents a cleartext-transmission vulnerability in the headset's wireless telemetry.

Research output

Wireless Interception of Functional Neuroimaging Transmissions

doi:10.22541/au.177196231.16660369/v1

Security findings

Coordinated Vulnerability Disclosure

CWE-319 • Cleartext Transmission of Sensitive Information

CWE
CWE-319
CVSS v3
3.1
CVSS v4
2.3

The affected product is the Mendi Neurofeedback Headset V4, in its Bluetooth Low Energy handler. Neural activity data is transmitted in cleartext, so an attacker able to observe BLE traffic within radio range can recover it. The attack requires adjacent access and is rated high complexity.

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

The vendor was contacted early about this disclosure but did not respond.

Disclosure timeline

  1. Initial vulnerability report to CNA (VulDB)
  2. No response from vendor; CVE entry published

External links

  1. CVE-2026-2671 (nist.gov)
  2. EUVD-2026-10185 (europa.eu)
  3. VulDB VDB-349702 (vuldb.com)

Revision history

March 2026
Initial release following public disclosure of CVE-2026-2671.