Executive brief
The garminconnect Python library, used to interact with Garmin Connect health and fitness data, incorrectly saved sensitive login tokens with world-readable file permissions. On shared computers or servers, this allows any other user to steal these tokens and gain persistent, unauthorized access to the victim's Garmin account, including their activity history and health data. Users should update the library and manually restrict permissions on existing token files.
Technical details
A vulnerability exists in the `Client.dump()` method of the `garminconnect` library where OAuth tokens are persisted to disk without explicit permission settings. On systems with a default umask of 022, the `garmin_tokens.json` file is created with world-readable permissions (0o644). An unprivileged local attacker can read this file to extract the `di_refresh_token`, which can be exchanged for fresh access tokens to maintain persistent access to the victim's Garmin Connect account. The fix in version 0.3.5 enforces 0o700 directory and 0o600 file permissions during the write process.
Affected products
- cyberjunky garminconnect <= 0.3.4
Timeline
- 2026-06-04: disclosed: Initial disclosure to vendor
- 2026-06-04: patched: Version 0.3.5 released
- 2026-07-15: advisory: GitHub Advisory published