The garminconnect package (≤ 0.3.4) stores OAuth tokens in a file named garmin_tokens.json without restricting file-system permissions, resulting in world-readable files under default Linux umask 022. The token file contains sensitive refresh tokens that can be used to obtain fresh access tokens from Garmin's OAuth endpoint. This vulnerability (CWE-732) allows local users on multi-user systems to steal credentials and access victim accounts. The issue is patched in version 0.3.5 by explicitly setting directory permissions to 0700 and file permissions to 0600 during token storage, independent of the system umask.

Local users on a multi-user Linux or macOS system can read the garmin_tokens.json file containing the OAuth refresh token due to insecure file permissions. This enables persistent unauthorized access to the victim's Garmin Connect account, including access to health and fitness data, activity history, and device management, until the token is revoked or rotated.

Upgrade garminconnect to version 0.3.5 or later, which enforces secure permissions (directory 0700, file 0600) on the token store regardless of umask. If immediate upgrade is not possible, manually restrict permissions on the token directory and file using 'chmod 700 ~/.garminconnect' and 'chmod 600 ~/.garminconnect/garmin_tokens.json'. Additionally, if the token file was exposed on a shared host, consider the refresh token compromised: delete the token store and re-authenticate to obtain a new token.