Mira Android App EUVD-2026-56978

Q: What is the CVSS score of EUVD-2026-56978?

EUVD-2026-56978 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-66832 MEDIUM

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-08-11 icscert

GHSA-rjjc-74j4-hf2v

Information Disclosure Google Mira Firmware Mira Android App Quanovate Tech Inc Operating As Mira Mira Care

6.9

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible passive disclosure triggered only by user interaction (UI:R); attacker needs no privileges; session token exposure yields high confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:53 vuln.today

CVE Published

Aug 11, 2026 - 20:49 cve.org

MEDIUM 6.9

DescriptionCVE.org

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

AnalysisAI

Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-598 (Use of GET Request Method With Sensitive Query Strings) describes the root cause: embedding authentication tokens in URLs rather than in request bodies or secure headers. URLs are structurally insecure carriers for secrets - they appear in browser and server access logs, are transmitted in HTTP Referer headers to third-party destinations, and are readable by any JavaScript executing in the same WebView context. The Mira Android app compounds this by also injecting a persistent user identifier into the User-Agent header, enabling third-party analytics or advertising networks receiving WebView traffic to correlate sessions across time and properties. Affected CPEs are cpe:2.3:a:quanovate_tech_inc._(operating_as_mira_/_mira_care):mira_android_app:*:*:*:*:*:*:*:* and cpe:2.3:a:quanovate_tech_inc._(operating_as_mira_/_mira_care):mira_firmware:*:*:*:*:*:*:*:*, indicating both the Android application layer and the underlying device firmware are within scope.

RemediationAI

Operators should consult CISA ICS medical advisory ICSMA-26-223-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01) for vendor patch instructions; a specific fixed version was not stated in the available input data, so the exact remediated release must be confirmed directly with Quanovate Tech Inc. or via the CSAF advisory at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json. As compensating controls pending a patch: mobile device management (MDM) policies can be used to block the Mira app from opening external WebView sessions to third-party domains, eliminating the token-in-URL transmission path at the cost of disabling shop redirect functionality. Network administrators can also implement egress filtering to prevent outbound WebView traffic to known third-party analytics and advertising endpoints. Session token rotation - configuring the Mira backend to invalidate tokens aggressively after short idle periods - reduces the exploitation window if tokens are already captured, though it does not prevent initial disclosure.