Cross-Stack Secret Management Library Vulnerability in Sealed-Env by David Almeida

CVE-2026-45091

What is CVE-2026-45091?

The Sealed-Env library, which facilitates cross-stack secret management for Node.js and Java/Spring Boot applications, contains a vulnerability in its enterprise mode. Versions from 0.1.0-alpha.1 to 0.1.0-alpha.3 inadvertently embed an operator's TOTP secret within the JWS payload of every generated unseal token. As the JWS payload is merely base64-encoded and not encrypted, it becomes susceptible to exposure. Adverse actors observing these tokens in CI build logs, container environment dumps, or other logging systems can easily decode the payload and retrieve the TOTP secret in plaintext. This significant flaw has been addressed in version 0.1.0-alpha.4.

References