PT-2026-60373 · Pypi · Garmin Connect
CVE-2026-54447
·
Published
2026-07-15
·
Updated
2026-07-23
CVSS v3.1
8.4
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
garminconnect versions prior to 0.3.5
Description
The software writes its OAuth token store to disk without restricting file-system permissions. On systems with a default Linux umask of
022, the token file garmin tokens.json is created as world-readable. This allows any local user on a shared host to read the file and extract the di refresh token, di token, and di client id variables. An attacker can use the stolen refresh token to obtain fresh access tokens via the Garmin OAuth endpoint, granting persistent unauthorized access to the victim's health data, activity history, and device management. The issue occurs within the dump() function of the Client class, which fails to specify a mode argument when creating the token directory and file.Recommendations
Upgrade to version 0.3.5 or later.
Manually restrict permissions by executing
chmod 700 ~/.garminconnect and chmod 600 ~/.garminconnect/garmin tokens.json for existing installations.
If the token file was exposed on a shared host, delete the token store and re-authenticate to rotate the compromised refresh token.Fix
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Garmin Connect