Description

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T21:17:49.713Z",
  "pubdate": "2026-08-11T21:17:49.713Z",
  "executiveSummary": "An information disclosure vulnerability exists in the Mira Android application when handling in-app WebView content such as shop redirect flows. The vulnerability arises because the application appends the user's live session token directly to the URL as a query string parameter and injects a persistent user identifier into the WebView's User-Agent header. Consequently, these sensitive authentication and identification materials are transmitted outward to third-party web properties, captured in intermediate referrer logs, and exposed to any arbitrary JavaScript executing within the WebView context. The risk implications include complete session hijacking, unauthorized account access, and persistent user tracking across external domains. Attackers require the capability to intercept network traffic, access server-side referrer logs, or execute malicious scripts within the affected WebView component to harvest the leaked credentials and identifiers. Exploitation requires user interaction to trigger the in-app WebView redirect flow, exposing active session tokens during normal application usage.",
  "technicalDetails": "The root cause of the vulnerability stems from improper session management and insecure data transmission practices within the Mira Android application's WebView implementation. When the application initiates in-app WebView content, specifically during shop redirect flows, it appends the user's live session token as a query string parameter within the target URL. Furthermore, the application appends a persistent user identifier directly into the custom User-Agent header of the WebView component. Because these values are transmitted via standard HTTP/HTTPS protocols to external third-party web properties, they are subjected to exposure across multiple vectors. First, query string parameters containing sensitive authentication tokens are persistently logged in intermediary proxy servers, web server access logs, and upstream HTTP Referrer headers when the WebView navigates to subsequent pages or loads external resources. Second, any third-party scripts, cross-origin content, or malicious scripts executing within the WebView context can directly access the document location object, extract the query string parameters containing the live session token, and exfiltrate them to attacker-controlled infrastructure. Additionally, any third-party web server receiving the HTTP request can extract the persistent user identifier from the User-Agent header and the session token from the request URI. The vulnerable component is the native-to-WebView bridging and URL construction logic within the Mira Android application. No special privileges or authentication are required by the attacker to exploit this flaw once the traffic is exposed; passive network sniffing, access to third-party server logs, or execution of malicious JavaScript within the WebView is sufficient. The post-exploitation impact allows an unauthorized actor to leverage the harvested live session token to impersonate the victim, bypass authentication mechanisms, and perform unauthorized actions on behalf of the user within the Mira ecosystem."
}