cyberjunky python-garminconnect vulnerabilities

Latest cyberjunky python-garminconnect CVEs

Newest publication first

1. CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

   Published 2026-09-14

   High·CVSS 8.4 EPSS 0.15%

   garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.