Skip to main content

Mira Android App EUVDEUVD-2026-56978

| CVE-2026-66832 MEDIUM
Use of GET Request Method With Sensitive Query Strings (CWE-598)
2026-08-11 icscert GHSA-rjjc-74j4-hf2v
Google Information Disclosure Mira Firmware Mira Android App
6.9
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-accessible passive disclosure triggered only by user interaction (UI:R); attacker needs no privileges; session token exposure yields high confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 11, 2026 - 23:53 vuln.today
CVE Published
Aug 11, 2026 - 20:49 cve.org
MEDIUM 6.9

DescriptionCVE.org

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

AnalysisAI

Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Victim authenticates to Mira Android app
Delivery
Navigates to in-app shop redirect WebView
Exploit
App appends live session token to WebView destination URL
Execution
Token transmitted in URL and Referer header to third-party web property
Persist
Attacker reads token from server access logs or WebView JavaScript context
Impact
Replays token against Mira API to hijack session
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability activates specifically when an authenticated Mira Android app user opens an in-app WebView flow - the shop redirect flow is explicitly named in the description. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N correctly reflects a network-accessible, low-complexity disclosure requiring user interaction (UI:A - the victim must open the WebView flow), with high confidentiality impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A third-party web property or analytics service embedded in the Mira shop redirect flow passively receives the victim's live session token in the URL query string and HTTP Referer header the moment the user opens the in-app WebView. The attacker, controlling or monitoring that third-party endpoint, extracts the token from server access logs or injected JavaScript and replays it against the Mira API to authenticate as the victim user. …
Remediation Operators should consult CISA ICS medical advisory ICSMA-26-223-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01) for vendor patch instructions; a specific fixed version was not stated in the available input data, so the exact remediated release must be confirmed directly with Quanovate Tech Inc. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mira Firmware

View all
CVE-2026-68067 CRITICAL
9.3 Aug 11

Authentication bypass in the Mira fertility-tracking cloud API allows any remote attacker to take over user accounts by

CVE-2026-66340 MEDIUM
6.9 Aug 11

Brute-force credential attacks against Mira's cloud authentication endpoints are unrestricted due to the complete absenc
CVE-2026-64934 MEDIUM
5.3 Aug 11

Firmware version spoofing in the Mira cloud API allows authenticated users to submit arbitrary firmware version strings

Same weakness CWE-598 – Use of GET Request Method With Sensitive Query Strings

View all
CVE-2023-6014 CRITICAL POC
9.8
CVE-2025-56551 HIGH POC
8.2
CVE-2026-23846 HIGH POC
8.1
CVE-2026-26721 HIGH POC
7.1
CVE-2017-3185 CRITICAL
9.8
CVE-2025-69270 CRITICAL
9.8
CVE-2018-14822 CRITICAL
9.8
CVE-2025-51651 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-56978 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy