CVE-2026-66832

Name of the Vulnerable Software and Affected Versions Mira Android app (affected versions not specified)

Description When the application opens in-app WebView content, such as shop redirect flows, the user's live session token is appended to the URL as a query string parameter. Additionally, a persistent user identifier is included in the WebView's User-Agent header. This results in sensitive information being transmitted to third-party web properties, referrer logs, and any JavaScript executing within the WebView context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.