CVE-2026-66832

MediumCVSS 6.5/10Last modified Sep 1, 2026

Description

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-598

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-668358.2Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected CVE-2026-668378.7Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift CVE-2026-668388.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Inject CVE-2026-668398.4NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An au CVE-2026-66844.6FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field CVE-2026-668408.7XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system informa CVE-2026-668428.8BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed CVE-2026-668436.1Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote atta CVE-2026-668494.3Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted a CVE-2026-668534.3Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visi CVE-2026-668588.7The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fie CVE-2026-668598.7NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: