Description

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_token, and another unprivileged user on a shared Linux or macOS host can read the token and obtain persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data. The Garmin.login tokenstore path is affected, and a pre-existing loosely permissioned token file remains exposed until rewritten or manually restricted. This issue is fixed in version 0.3.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-14T20:16:46.290Z",
  "pubdate": "2026-09-14T20:16:46.290Z",
  "executiveSummary": "The garminconnect Python API wrapper, prior to version 0.3.5, exhibits an insecure file permission vulnerability within its token management mechanism. The library fails to explicitly set restricted filesystem permissions when creating the OAuth token directory and the garmin_tokens.json file.\nOn shared Linux or macOS multi-user environments, this results in the storage of sensitive authentication material with overly permissive access rights (e.g., 0644 or 0755), allowing unprivileged local users to read the victim's persistent OAuth refresh tokens.\nThe vulnerability poses a significant risk to user privacy, as unauthorized access to these tokens grants the attacker persistent, authenticated access to the user's Garmin Connect account. This exposure enables the exfiltration of sensitive health, fitness, activity, and device-related telemetry. The vulnerability is categorized as an Insecure Default File Permission issue. Mitigation requires an upgrade to version 0.3.5 or higher and manual remediation of existing filesystems where permissive tokens may persist.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the Client.dump method within garminconnect/client.py. When the application initializes the OAuth token storage, it performs filesystem operations to create the directory and the garmin_tokens.json file without invoking explicit system-level permission masks or utilizing secure file creation primitives (e.g., os.umask or os.chmod with 0600 modes).\nUnder a standard permissive umask (such as 022), the operating system defaults the creation of directories to 0755 and files to 0644. This grants read access to all users on the host machine, effectively bypassing the expected confidentiality of authentication credentials stored in the user's home directory.\nThe attack flow proceeds as follows: An unprivileged local attacker identifies the path utilized by the Garmin.login method for token storage. Because the files are stored with world-readable permissions, the attacker executes standard read operations on garmin_tokens.json. The file contains the di_refresh_token, which is a long-lived credential. By extracting this token, the attacker can impersonate the victim against the Garmin Connect API endpoints.\nThe vulnerability is persistent. Even if the application logic is updated, a pre-existing garmin_tokens.json file that was generated by a vulnerable version retains its original permissive mode until explicitly modified or rewritten by a secure version of the library. Post-exploitation, the attacker maintains persistent access to the victim's account, allowing them to scrape health and fitness data, monitor device activity, and access personal profile information indefinitely until the session is revoked or the token is invalidated.\nAffected versions include all releases prior to 0.3.5. The vulnerability requires no network exposure, as it relies on local filesystem access, making it a critical concern for shared workstations or systems with multiple local users."
}