io.github.davidalmeidac vulnerabilities

Products

• io.github.davidalmeidac/sealed-env-core 1

Latest io.github.davidalmeidac CVEs

Newest publication first

1. CVE-2026-45091 sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

   Published 2026-05-12

   Critical·CVSS 9.1 EPSS 0.33%

   sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.