NeoRhythm

Published
March 2026
Updated
August 2026

Overview

NeoRhythm is a pulsed electromagnetic field (PEMF) headband from OmniPEMF, controlled from a companion application over Bluetooth Low Energy (BLE). Five internal coils produce a trapezoidal pulsed field at 1–303 Hz, up to 2.5 mT. This report documents a missing-authentication vulnerability in the device's wireless control interface.

Security findings

Coordinated Vulnerability Disclosure

CWE-306 • Missing Authentication for Critical Function

CWE
CWE-306
CVSS v3
5.0
CVSS v4
2.3

The affected product is OmniPEMF NeoRhythm up to build 20260308, in its BLE interface. Because the interface performs no authentication, an attacker within radio range can reach device functions directly. The attack requires adjacent access and is rated high complexity.

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

The vendor was contacted early about this disclosure but did not respond.

Disclosure timeline

  1. Initial vulnerability report to CNA (VulDB)
  2. No response from vendor; CVE entry published

External links

  1. CVE-2026-2756 (nist.gov)
  2. EUVD-2026-14254 (europa.eu)
  3. VulDB VDB-352383 (vuldb.com)

Revision history

March 2026
Initial release following public disclosure of CVE-2026-2756.