CVE-2026-54447
Received Received - Intake

Garmin Connect OAuth Token File Exposure via Permissive Umask

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_token, and another unprivileged user on a shared Linux or macOS host can read the token and obtain persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data. The Garmin.login tokenstore path is affected, and a pre-existing loosely permissioned token file remains exposed until rewritten or manually restricted. This issue is fixed in version 0.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54447

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
garmin garminconnect 0.3.5
cyberjunky python_garminconnect to 0.3.5 (exc)
cyberjunky python_garminconnect 0.3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the python-garminconnect library before version 0.3.5. It involves insecure file permissions when storing OAuth tokens. The library creates a token file (garmin_tokens.json) with overly permissive permissions (0644), making it readable by any user on a shared system. This allows unauthorized local users to access the victim's Garmin Connect account data, including health and fitness information.

Detection Guidance

Check for overly permissive token files by running: ls -l ~/.garmin_tokens.json or ls -ld ~/.garminconnect. If the file permissions show 644 or directory permissions show 755, the system is vulnerable. Also verify if the token file contains sensitive data like di_refresh_token.

Impact Analysis

If you use this library on a shared Linux or macOS system, another user could read your garmin_tokens.json file and extract your DI refresh token. This grants them persistent access to your Garmin Connect account, exposing sensitive data like health records, fitness activities, and device information. The impact includes loss of privacy and potential misuse of your account.

Compliance Impact

This vulnerability could lead to unauthorized access to personal health and fitness data, which may violate GDPR (General Data Protection Regulation) due to improper protection of personal data. For HIPAA (Health Insurance Portability and Accountability Act), it risks exposing protected health information if health data is involved. Organizations must ensure proper access controls to maintain compliance.

Mitigation Strategies

Upgrade to version 0.3.5 or later of python-garminconnect. If upgrading is not possible, manually set strict permissions: chmod 700 ~/.garminconnect and chmod 600 ~/.garminconnect/garmin_tokens.json. Remove any pre-existing loose permission tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart