garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store (CVE-2026-54447)

The garminconnect Python 3 API wrapper for Garmin Connect had a security flaw in versions before 0.3.5 where the Client.dump method created the OAuth token directory and garmin_tokens.json file with permissive permissions (e.g., directory mode 0755 and file mode 0644 under a umask of 022). Because garmin_tokens.json contains the di_refresh_token, other unprivileged users on a shared host could read this file and obtain persistent access to the victim's Garmin Connect account, including sensitive health, fitness, activity, and device data. The vulnerability affects the Garmin.login tokenstore path. The issue is resolved in version 0.3.5 by enforcing stricter permission settings on the token storage.

An attacker with unprivileged access to the same Linux or macOS host as a victim can read the OAuth token file due to insecure file permissions. This allows the attacker to obtain persistent access to the victim's Garmin Connect account, compromising confidentiality and integrity of sensitive personal data such as health and fitness information. There is no indication of impact on availability. No known exploits in the wild have been reported.

A fix is available in garminconnect version 0.3.5, which enforces proper owner-only permissions on the OAuth token directory and file. Users should upgrade to version 0.3.5 or later. For existing installations, manually restrict permissions on the token directory and garmin_tokens.json file to owner-only access until upgrading.