Vulnerabilities CVE-2026-66832

CVE-2026-66832

Medium

Open

TLP:CLEAR

Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

Details

CVSS Score: 6.9
EPSS Score ⓘ: 0.22%

13.3th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 11, 2026
Last Modified: Aug 12, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.