Unrated

Insecure OAuth Token File Permissions in garminconnect

IdentifiersCVE-2026-54447CWE-732

CVE-2026-54447 is an insecure permission assignment vulnerability in garminconnect affecting versions through 0.3.4. The application may create its Garmin OAuth token store with overly permissive filesystem permissions, resulting in a world-readable token file. Because the stored refresh token can be used to obtain continued authenticated access, a local user on the same host may read the token and impersonate the victim's Garmin Connect session. The issue is particularly relevant on multi-user Linux or macOS systems where the effective umask or file-creation behavior permits broader read access than intended.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows another local user on the same system to obtain the victim's OAuth refresh token and maintain unauthorized access to the victim's Garmin Connect account until the token is revoked or rotated. This can expose sensitive account data including health and fitness information, activity history, and device-management capabilities. The compromise may persist beyond the initial file read because the refresh token can be reused to obtain renewed authenticated access.

Mitigation

If you can’t patch tonight, do this now.

Where immediate upgrade is not possible, manually enforce owner-only permissions on the token storage location and file so that other local users cannot read the stored refresh token. This is most important on shared Linux or macOS hosts and environments with permissive umask settings. Administrators should also review existing deployments for previously created token files that may already have been exposed and rotate tokens if compromise is suspected.

Remediation

Patch, then assume compromise.

Upgrade to garminconnect 0.3.5 or later, which addresses the insecure token-store permission handling. Existing token files created by vulnerable versions should also be remediated by restricting permissions to owner-only access or deleting the token store and re-authenticating so that a fresh token is generated. If the token file may have been exposed on a shared system, the refresh token should be treated as compromised and rotated or revoked through re-authentication.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity