CVE-2026-66832CWE-598

CVE-2026-66832

Medium · published August 12, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00389 · 31.8th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2026-08-12T01:17Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json · [email protected]https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 · [email protected]
EPSS history
Timeline
  • 11 AUG 20:49Z
    Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
    cvelistv5