Executive brief
sealed-env is a security library used to manage sensitive application secrets in Node.js and Java environments. A flaw in its enterprise mode causes the master multi-factor authentication (TOTP) secret to be included in plain text within every security token generated by the system. If these tokens are captured in logs, monitoring tools, or container metadata, an attacker could gain permanent access to bypass security controls and generate their own valid credentials, compromising the entire secret management system.
Technical details
In sealed-env enterprise mode, the library incorrectly includes the literal TOTP secret within the JSON Web Signature (JWS) payload of minted unseal tokens. Because JWS payloads are only Base64-encoded and not encrypted, the secret is effectively stored in plaintext. An attacker who gains access to these tokens—which are frequently exposed in CI/CD logs, container environment dumps, or log aggregators—can extract the TOTP secret. When combined with a master key, this allows an attacker to bypass multi-factor authentication and generate valid unseal tokens indefinitely. The issue is resolved in version 0.1.0-alpha.4 by using a salt-bound HMAC derivative instead of the raw secret.
Affected products
- davidalmeidac sealed-env 0.1.0-alpha.1 through 0.1.0-alpha.3
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD