CVE-2026-54447

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

CVE-2026-54447

garminconnect (versions ≤ 0.3.4) is a Python 3 API wrapper for Garmin Connect that stores OAuth tokens in ~/.garminconnect/garmin_tokens.json. The Client.dump() method created the token directory and file without specifying restrictive file modes, so under a permissive umask (e.g., 022) the token...

EUVD-2026-77804

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

clawhealth (>=0.1.0, <=0.1.1), garmin-auth (>=0.1.1, <=0.2.1) +9 more potentially affected by CVE-2026-54447 via garminconnect (>=0.1.49, <=0.3.3)

garminconnect PYPI version =0.1.49, =0.1.0, =0.1.1, =1.0.2, =2.7.0, =0.9.5, =0.1.2, =0.1.1, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-54447 Source advisory: MEND:CVE-2026-54447...

CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

CVE-2026-54447: Incorrect Permission Assignment for Critical Resource

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

Insecure Permission Assignment for Garmin OAuth Token Store Summarygarminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...

clawhealth (>=0.1.0, <=0.1.1), garmin-auth (>=0.1.1, <=0.2.1) +9 more potentially affected by CVE-2026-54447 via garminconnect (>=0.1.49, <=0.3.3)

garminconnect PYPI version =0.1.49, =0.1.0, =0.1.1, =1.0.2, =2.7.0, =0.9.5, =0.1.2, =0.1.1, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-54447 Source advisory: OSV:PYSEC-2026-3467...

PYSEC-2026-3467 garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...

clawhealth (>=0.1.0, <=0.1.1), garmin-auth (>=0.1.1, <=0.2.1) +9 more potentially affected by CVE-2026-54447 via garminconnect (>=0.1.49, <=0.3.3)

garminconnect PYPI version =0.1.49, =0.1.0, =0.1.1, =1.0.2, =2.7.0, =0.9.5, =0.1.2, =0.1.1, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-54447 Source advisory: OSV:GHSA-WJHR-76VG-2HVC...

Incorrect Permission Assignment for Critical Resource

Overview garminconnect is a Python 3 API wrapper for Garmin Connect Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to insecure file-system permissions being set on the OAuth token store by the dump function. An attacker can gain...

clawhealth (>=0.1.0, <=0.1.1), garmin-auth (>=0.1.1, <=0.2.1) +9 more potentially affected by CVE-2026-54447 via garminconnect (>=0.1.49, <=0.3.3)

garminconnect PYPI version =0.1.49, =0.1.0, =0.1.1, =1.0.2, =2.7.0, =0.9.5, =0.1.2, =0.1.1, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-54447 Source advisory: GHSA-WJHR-76VG-2HVC...

clawhealth (>=0.1.0, <=0.1.1), garmin-auth (>=0.1.1, <=0.2.1) +9 more potentially affected by CVE-2026-54447 via garminconnect (>=0.1.49, <=0.3.3)

garminconnect PYPI version =0.1.49, =0.1.0, =0.1.1, =1.0.2, =2.7.0, =0.9.5, =0.1.2, =0.1.1, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-54447 Source advisory: SNYK:PYTHON-GARMINCONNECT-18017906...

PT-2025-41569

Уязвимость онлайн-платформы GarminConnect связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю получить доступ к защищаемой информации...