OAuth Token Exposure in Garmin Connect API Wrapper by Garmin

CVE-2026-54447

What is CVE-2026-54447?

The Garmin Connect API wrapper for Python 3 has a vulnerability where the OAuth token directory and token file are created with overly permissive permissions. Specifically, prior to version 0.3.5, the ‘garmin_tokens.json’ file could be accessed by other users on shared Linux or macOS environments, compromising the security of user health, fitness, and activity data. The issue arises from the lack of strict owner-only modes during the creation of these files, making it possible for unprivileged users to read sensitive information if the umask is set permissively. Users are advised to upgrade to version 0.3.5 to mitigate this risk.

References