CVE-2026-66832
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.
Risk Assessment
The risk includes leakage of session token and user identifier to third parties, potentially enabling session hijacking or user tracking. This may lead to privacy and account security breaches.
Recommendation
It is recommended that the app not pass session tokens in URLs or User-Agent headers. Also restrict WebView content to trusted domains and use secure authentication mechanisms.
Original NVD description (English source)
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.