The python-garminconnect library contains an insecure file permission vulnerability that exposes sensitive OAuth tokens to unauthorized local users, posing a high risk of account takeover.

The vulnerability exists due to incorrect permission assignment (CWE-732) during the creation of the OAuth token directory and the garmin_tokens.json file. Because these files are created without strict owner-only access modes, a local unprivileged user on a shared system can read the refresh token and gain persistent unauthorized access to the victim's Garmin Connect account.

A successful exploit allows an attacker to gain full access to a user's sensitive Garmin Connect profile. This results in the potential compromise of private health, fitness, activity, and device data. Given the CVSS score of 8.4, this is a high-severity issue that necessitates immediate attention, particularly in multi-user environments where local privilege boundaries are expected to protect user data.

Immediate Action: Update the python-garminconnect package to version 0.3.5 or later, which enforces strict file permissions. If an update is not immediately possible, manually restrict the permissions of the garmin_tokens.json file and its parent directory to read and write only for the owner (chmod 600 for the file and 700 for the directory).

Proactive Monitoring: Audit local file systems for applications that store sensitive credentials in world-readable or group-readable locations. Review system logs for unauthorized access attempts to directories where sensitive configuration data is stored.

Compensating Controls: Ensure that sensitive applications are executed within isolated environments, such as containers or sandboxes, to limit the visibility of local file system resources to other users.

Public Exploit Available: No (exploit_available unknown)

The risk posed by CVE-2026-54447 is significant for any environment running this library on a multi-user Linux or macOS system. Administrators should prioritize updating the library to version 0.3.5 to ensure that sensitive OAuth tokens are protected by appropriate file system permissions. If immediate patching is not feasible, manual permission remediation on existing token stores is mandatory to prevent unauthorized data access.