Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-66832

Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware

Default version status: unaffected

  • 1.7.1.47affected
  • 01.07.01.53unaffected

Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App

Default version status: unaffected

  • 4.5.15.4affected
  • 4.5.18unaffected

References