Description
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware | 1.7.1.47 | 01.07.01.53 |
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App | 4.5.15.4 | 4.5.18 |
Advisories 1
- ICSMA-26-223-01 Mira Hormone Monitor, Mira Android App CISA ICS & IT advisories · Aug 11, 2026