CVE-2026-54447: garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim’s Garmin Connect account.
- Severity: High
- Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
- Affected versions:
<= 0.3.4 - Patched version:
0.3.5
References
- github.com/advisories/GHSA-wjhr-76vg-2hvc
- github.com/cyberjunky/python-garminconnect/commit/77a3837f1f79d486663c9646438e70e8319e1a48
- github.com/cyberjunky/python-garminconnect/commit/f74174a5647e1af78eca1f8f3a0aa5dc5a899947
- github.com/cyberjunky/python-garminconnect/releases/tag/0.3.5
- github.com/cyberjunky/python-garminconnect/security/advisories/GHSA-wjhr-76vg-2hvc
- nvd.nist.gov/vuln/detail/CVE-2026-54447
Code Behaviors & Features
Detect and mitigate CVE-2026-54447 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →