The Mira Android application embeds user session tokens and a persistent user identifier in the URL query string when loading in‑app WebView content, such as shop redirect flows. These values are also reflected in the WebView's User‑Agent header. Because the tokens are sent as GET parameters, they can be recorded by third‑party web services, referrer logs, and any JavaScript executing in the WebView context. The result is that confidential session credentials and user identifiers may be unintentionally disclosed to external parties, which could enable unauthorized access to the user's account or personal data. The weakness is identified as CWE‑598, sensitive information leakage via URL.

Affected vendors include Quanovate Tech Inc., operating as Mira or Mira Care. The Mira Android App is impacted, as are devices running Mira Firmware that rely on the app for updates. The current work‑around is to install the latest available software: the Android app should be updated to version 4.5.18, and the firmware should be refreshed to v01.07.01.53 through the app. No other versions are specifically noted as vulnerable.

The CVSS base score is 6.9, indicating a medium‑to‑high severity risk. An EPSS score of less than 1% signals a very low likelihood of observed exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the GET request mechanism by directing users to malicious third‑party web pages that capture the exposed session tokens or user IDs, or by observing referrer logs. The vulnerability is a client‑side issue: if users install the vulnerable app and visit targeted URLs, the data leakage occurs automatically without additional input from the attacker. Since the vulnerability is not yet exploited at scale, the immediate risk is moderate, but the presence of session tokens in the URL makes the issue potentially critical if exploited.