CVE-2026-54447

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_token, and another unprivileged user on a shared Linux or macOS host can read the token and obtain persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data. The Garmin.login tokenstore path is affected, and a pre-existing loosely permissioned token file remains exposed until rewritten or manually restricted. This issue is fixed in version 0.3.5.

• CWE-732

• https://github.com/cyberjunky/python-garminconnect/commit/8256b577190b446e279c81b845d8e27d0ea1fbf5
• https://github.com/cyberjunky/python-garminconnect/releases/tag/0.3.5
• https://github.com/cyberjunky/python-garminconnect/security/advisories/GHSA-wjhr-76vg-2hvc

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54433In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, t…10
• CVE-2026-5444A heap buffer overflow vulnerability exists in the PAM image…7.1
• CVE-2026-54443Dashy is a self-hostable personal dashboard. From 1.9.4 unti…5.9
• CVE-2026-54444Rejected reason: ]** REJECT ** DO NOT USE THIS CANDIDATE NUM…
• CVE-2026-54445vantage6 is an open-source infrastructure for privacy preser…6.9
• CVE-2026-54446NetLicensing MCP Server is a natural-language interface that…8.1
• CVE-2026-54448Trivy is a security scanner. Prior to 0.71.0, when Trivy sca…6.5
• CVE-2026-54449LangBot is a global IM bot platform designed for LLMs. In ve…8.8
• CVE-2026-5445An out-of-bounds read vulnerability exists in the `DecodeLoo…9.1
• CVE-2026-54450ToolHive is a utility designed to simplify the deployment an…2.9
• CVE-2026-54451Elixir protobuf is a pure Elixir implementation of Google Pr…8.2
• CVE-2026-54452safeurl is a server-side request forgery protection library.…6.3