CyberRota Analysis
AI-GeneratedThe Mira Android app is vulnerable due to the exposure of users' live session tokens and persistent identifiers through URL query strings and the User-Agent header when rendering in-app WebView content. This could lead to session hijacking and unauthorized access to user accounts, particularly affecting users who interact with third-party web properties. Developers and security teams of applications utilizing the Mira app should prioritize addressing this vulnerability to protect user data and maintain session integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.