CVE-2026-66832: falha de média gravidade em Quanovate Tech Inc. (operating as Mira / Mira…
Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Quanovate Tech Inc. (operating as Mira / Mira Care) · Mira Android AppQuanovate Tech Inc. (operating as Mira / Mira Care) · Mira FirmwareCVEs relacionadas — Quanovate Tech Inc. (operating as Mira / Mira…
No mesmo produto, das mais perigosas para as menos.
CVE-2026-68067CRITICALMira Hormone Monitor, Mira Android App Weak AuthenticationEPSS 0.5%CVE-2026-67568CRITICALMira Hormone Monitor, Mira Android App Use of Hard-coded CredentialsEPSS 0.4%CVE-2026-66875HIGHMira Hormone Monitor, Mira Android App Missing authentication for critical functionEPSS 0.4%CVE-2026-66340MEDIUMMira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attemptsEPSS 0.4%CVE-2026-66098HIGHMira Hormone Monitor, Mira Android App Missing authentication for critical functionEPSS 0.3%CVE-2026-64934MEDIUMMira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decisionEPSS 0.3%