garminconnect

Version	Released
`0.3.20` patch	Oct 23, 2026
`0.3.19` patch	Oct 16, 2026
`0.3.18` patch	Oct 15, 2026
`0.3.17` patch	Sep 29, 2026
`0.3.16` patch	Sep 18, 2026
`0.3.15` patch	Sep 12, 2026
`0.3.14` patch	Sep 12, 2026
`0.3.13` patch	Sep 09, 2026
`0.3.11` patch	Aug 19, 2026
`0.3.10` patch	Aug 11, 2026
`0.3.9` patch	Aug 07, 2026
`0.3.8` patch	Jul 30, 2026
`0.3.7` patch	Jul 26, 2026
`0.3.6` patch	Jun 14, 2026
`0.3.5` patch	Jun 04, 2026
`0.3.4` patch 1 CVE	Jun 02, 2026
`0.3.3` patch 1 CVE	Apr 22, 2026
`0.3.2` patch 1 CVE	Apr 11, 2026
`0.3.1` patch 1 CVE	Apr 03, 2026
`0.3.0` minor 1 CVE	Apr 02, 2026
`0.2.40` patch 1 CVE	Mar 16, 2026
`0.2.39` patch 1 CVE	Mar 16, 2026
`0.2.38` patch 1 CVE	Jan 04, 2026
`0.2.37` patch 1 CVE	Jan 02, 2026
`0.2.36` patch 1 CVE	Nov 29, 2025
`0.2.35` patch 1 CVE	Nov 28, 2025
`0.2.34` patch 1 CVE	Nov 10, 2025
`0.2.33` patch 1 CVE	Nov 09, 2025
`0.2.31` patch 1 CVE	Nov 04, 2025
`0.2.30` patch 1 CVE	Sep 06, 2025
`0.2.29` patch 1 CVE	Sep 06, 2025
`0.2.28` patch 1 CVE	Jun 09, 2025
`0.2.27` patch 1 CVE	Jun 05, 2025
`0.2.26` patch 1 CVE	Apr 04, 2025
`0.2.25` patch 1 CVE	Dec 14, 2024
`0.2.24` patch 1 CVE	Dec 12, 2024
`0.2.23` patch 1 CVE	Nov 27, 2024
`0.2.22` patch 1 CVE	Nov 27, 2024
`0.2.21` patch 1 CVE	Nov 24, 2024
`0.2.20` patch 1 CVE	Nov 10, 2024
`0.2.19` patch 1 CVE	Jul 06, 2024
`0.2.18` patch 1 CVE	May 27, 2024
`0.2.17` patch 1 CVE	Apr 25, 2024
`0.2.16` patch 1 CVE	Apr 06, 2024
`0.2.15` patch 1 CVE	Mar 18, 2024
`0.2.14` patch 1 CVE	Mar 15, 2024
`0.2.13` patch 1 CVE	Jan 22, 2024
`0.2.12` patch 1 CVE	Dec 22, 2023
`0.2.11` patch 1 CVE	Nov 23, 2023
`0.2.10` patch 1 CVE	Nov 21, 2023

0.3.20 patch

Oct 23, 2026

0.3.19 patch

Oct 16, 2026

0.3.18 patch

Oct 15, 2026

0.3.17 patch

Sep 29, 2026

0.3.16 patch

Sep 18, 2026

0.3.15 patch

Sep 12, 2026

0.3.14 patch

Sep 12, 2026

0.3.13 patch

Sep 09, 2026

0.3.11 patch

Aug 19, 2026

0.3.10 patch

Aug 11, 2026

0.3.9 patch

Aug 07, 2026

0.3.8 patch

Jul 30, 2026

0.3.7 patch

Jul 26, 2026

0.3.6 patch

Jun 14, 2026

0.3.5 patch

Jun 04, 2026

0.3.4 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Jun 02, 2026

0.3.3 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Apr 22, 2026

0.3.2 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Apr 11, 2026

0.3.1 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Apr 03, 2026

0.3.0 minor

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Apr 02, 2026

0.2.40 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Mar 16, 2026

0.2.39 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Mar 16, 2026

0.2.38 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Jan 04, 2026

0.2.37 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Jan 02, 2026

0.2.36 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 29, 2025

0.2.35 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 28, 2025

0.2.34 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 10, 2025

0.2.33 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 09, 2025

0.2.31 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 04, 2025

0.2.30 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Sep 06, 2025

0.2.29 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Sep 06, 2025

0.2.28 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Jun 09, 2025

0.2.27 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Jun 05, 2025

0.2.26 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Apr 04, 2025

0.2.25 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Dec 14, 2024

0.2.24 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Dec 12, 2024

0.2.23 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 27, 2024

0.2.22 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 27, 2024

0.2.21 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 24, 2024

0.2.20 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 10, 2024

0.2.19 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Jul 06, 2024

0.2.18 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

May 27, 2024

0.2.17 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Apr 25, 2024

0.2.16 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Apr 06, 2024

0.2.15 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Mar 18, 2024

0.2.14 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Mar 15, 2024

0.2.13 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Jan 22, 2024

0.2.12 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Dec 22, 2023

0.2.11 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 23, 2023

0.2.10 patch

1 CVE

CVE-2026-54447 PYSEC-2026-3467 GHSA-wjhr-76vg-2hvc Jul 23, 2026

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

8.4 / 10

High

Local Low Low None Changed High High None

Insecure Permission Assignment for Garmin OAuth Token Store

Summary

garminconnect (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (022) the token file garmin_tokens.json was created world-readable (0o644). The file contains the DI refresh token, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.

Severity: High
Weakness: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Affected versions: <= 0.3.4
Patched version: 0.3.5

Details

Client.dump() created the token directory and file with no mode argument, leaving permissions entirely to the process umask:

def dump(self, path: str) -> None:
    p = Path(path).expanduser()
    if p.is_dir() or not p.name.endswith(".json"):
        p = p / "garmin_tokens.json"
    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=
    p.write_text(self.dumps())                     # no permission restriction

The serialized payload includes di_token, di_refresh_token, and di_client_id. The call is in the core library (Garmin.login(tokenstore=...) persists tokens this way), and all shipped usage examples default the token store to ~/.garminconnect.

Under umask 022 the resulting permissions were:

token directory → 0o755
garmin_tokens.json → 0o644 (world-readable)

A separate, unprivileged user on the same machine could read the file with a plain open() — no elevated privileges required — and extract the refresh token.

Impact

Local credential theft / privilege escalation on multi-user Linux or macOS hosts running under a permissive umask. The stolen refresh token can be exchanged for fresh access tokens via Garmin's OAuth endpoint, granting ongoing access to the victim's account (health/fitness data, activity history, device management) until the token is revoked.

Patch

Fixed in 0.3.5 (commit 77a3837). dump() now creates the directory as 0o700 and writes the token file as 0o600 regardless of umask — using os.open(..., O_CREAT|O_WRONLY|O_TRUNC, 0o600) with O_NOFOLLOW where available, plus a defensive chmod that also tightens a pre-existing loose file:

p.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with contextlib.suppress(OSError):
    p.parent.chmod(0o700)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
if hasattr(os, "O_NOFOLLOW"):
    flags |= os.O_NOFOLLOW
fd = os.open(p, flags, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    f.write(self.dumps())
with contextlib.suppress(OSError):
    p.chmod(0o600)

Verified under umask 022: directory 0o700, file 0o600, no group/other access.

Workarounds

If you cannot upgrade immediately, restrict the token store manually and keep it owner-only:

chmod 700 ~/.garminconnect
chmod 600 ~/.garminconnect/garmin_tokens.json

Remediation

Upgrade to garminconnect >= 0.3.5:
```
pip install --upgrade garminconnect
```
Fix any token file already on disk — upgrading only tightens permissions on the next write, so an existing world-readable file stays exposed until then:
```
chmod 600 ~/.garminconnect/garmin_tokens.json
# or remove it and log in again to mint a fresh token store
```
If the file was exposed on a shared host, treat the refresh token as compromised. Re-authenticate (delete the token store and log in again) so a new token is issued; consider the previously stored token potentially read by others until rotated.

Credit

Reported by EQSTLab via a private security advisory. garminconnect thanks them for the detailed, responsible disclosure.

Affected versions


          0.1.1


          0.1.10


          0.1.11


          0.1.12


          0.1.13


          0.1.14


          0.1.15


          0.1.16


          0.1.17


          0.1.18


          0.1.19


          0.1.2

+ 86 more


            0.1.21


            0.1.22


            0.1.23


            0.1.24


            0.1.25


            0.1.26


            0.1.27


            0.1.28


            0.1.29


            0.1.3


            0.1.30


            0.1.31


            0.1.32


            0.1.33


            0.1.34


            0.1.35


            0.1.36


            0.1.37


            0.1.38


            0.1.39


            0.1.4


            0.1.40


            0.1.41


            0.1.42


            0.1.43


            0.1.44


            0.1.45


            0.1.46


            0.1.47


            0.1.48


            0.1.49


            0.1.5


            0.1.50


            0.1.51


            0.1.52


            0.1.53


            0.1.54


            0.1.55


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.1


            0.2.10


            0.2.11


            0.2.12


            0.2.13


            0.2.14


            0.2.15


            0.2.16


            0.2.17


            0.2.18


            0.2.19


            0.2.2


            0.2.20


            0.2.21


            0.2.22


            0.2.23


            0.2.24


            0.2.25


            0.2.26


            0.2.27


            0.2.28


            0.2.29


            0.2.3


            0.2.30


            0.2.31


            0.2.33


            0.2.34


            0.2.35


            0.2.36


            0.2.37


            0.2.38


            0.2.39


            0.2.4


            0.2.40


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            0.3.4

Fixed in


          0.3.5

References

Updated Jul 23, 2026 · Source: OSV.dev

Nov 21, 2023

Activity

Reach

Details