High, CVSS 8.4PyPIAmendedPublished
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
CVE-2026-54447 · GHSA-wjhr-76vg-2hvc
- Affected
- PyPI garminconnect <= 0.3.4
- Fixed in
- 0.3.5· Vendor fix available
- Issue
- Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmintokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account. - Severity: High - Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource) - Affected versions: <= 0.3.4 - Patched version: 0.3.5 Details Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask: The serialized payload includes ditoken, direfreshtoken, and diclientid. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect. Under umask 022 the…
Recommended action: Upgrade to 0.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.