CVE-2026-54447 json
garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store
published 3mo ago modified last mo. also GHSA-wjhr-76vg-2hvc , PYSEC-2026-3467 , EUVD-2026-77804
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_token, and another unprivileged user on a shared Linux or macOS host can read the token and obtain persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data. The Garmin.login tokenstore path is affected, and a pre-existing loosely permissioned token file remains exposed until rewritten or manually restricted. This issue is fixed in version 0.3.5.
Patch / fix
- pypi garminconnect 0.3.5
Is CVE-2026-54447 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| OSV | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| GitHub | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | garminconnect | <0.3.5 |
0.3.5 |
Affected products
- cyberjunky python-garminconnect
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
- github.com /cyberjunky/python-garminconnect/commit/8256b577190b446e279c81b845d8e27d0ea1fbf5
-
github.com
/cyberjunky/python-garminconnect/commit/77a3837f1f79d486663c9646438e70e8319e1a48
web
-
github.com
/cyberjunky/python-garminconnect/commit/f74174a5647e1af78eca1f8f3a0aa5dc5a899947
web
-
github.com
/cyberjunky/python-garminconnect/security/advisories/GHSA-wjhr-76vg-2hvc
web
-
github.com
/cyberjunky/python-garminconnect/releases/tag/0.3.5
web
-
github.com
/cyberjunky/python-garminconnect
package
-
pypi.org
/project/garminconnect
package
-
github.com
/advisories/GHSA-wjhr-76vg-2hvc
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-54447
advisory
Sources
- CVE List CVE-2026-54447
- GitHub Advisory GHSA-wjhr-76vg-2hvc
- NVD CVE-2026-54447
- OSV PYSEC-2026-3467
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.