---
id: CVE-2026-54447
title: >-
  garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves
  statistics and manages activities
summary: >-
  garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves
  statistics and manages activities. Prior to 0.3.5, garminconnect/client.py
  Client.dump creates the OAuth token directory and garmin_tokens.json without
  explicit ow…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-732
vendor: cyberjunky
product: python-garminconnect
affected:
  - python-garminconnect < 0.3.5
patched:
  - garminconnect 0.3.5
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:16:46.290'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54447'
references:
  - url: >-
      https://github.com/cyberjunky/python-garminconnect/commit/8256b577190b446e279c81b845d8e27d0ea1fbf5
    label: security-advisories@github.com
  - url: 'https://github.com/cyberjunky/python-garminconnect/releases/tag/0.3.5'
    label: security-advisories@github.com
  - url: >-
      https://github.com/cyberjunky/python-garminconnect/security/advisories/GHSA-wjhr-76vg-2hvc
    label: security-advisories@github.com
  - url: >-
      https://github.com/cyberjunky/python-garminconnect/commit/77a3837f1f79d486663c9646438e70e8319e1a48
  - url: >-
      https://github.com/cyberjunky/python-garminconnect/commit/f74174a5647e1af78eca1f8f3a0aa5dc5a899947
  - url: 'https://github.com/advisories/GHSA-wjhr-76vg-2hvc'
tags:
  - nvd
  - cve.org
  - ghsa
  - pip
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T20:09:53.554592Z'
aliases:
  - GHSA-wjhr-76vg-2hvc
ecosystem: pip
ingestedAt: '2026-07-15T17:44:34.490Z'
epss: 0.00151
epssPercentile: 0.03591
---

## Overview

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_token, and another unprivileged user on a shared Linux or macOS host can read the token and obtain persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data. The Garmin.login tokenstore path is affected, and a pre-existing loosely permissioned token file remains exposed until rewritten or manually restricted. This issue is fixed in version 0.3.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54447)

Affected packages:

- `garminconnect <= 0.3.4`

Patched in:

- `garminconnect 0.3.5`

Source: https://github.com/advisories/GHSA-wjhr-76vg-2hvc