CVE-2026-45091

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45091
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45091.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45091
Aliases
Published
2026-05-12T13:20:21.560Z
Modified
2026-08-12T16:24:34.802814Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Details

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45091.json",
    "cwe_ids": [
        "CWE-200",
        "CWE-522"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/davidalmeidac/sealed-env

Affected ranges

Type
GIT
Repo
https://github.com/davidalmeidac/sealed-env
Events
Introduced
e8aabd3ff59321fe90416a03ae8e7cfa69a3ab60
Fixed
b375bb137db4b075beeec7b6af59d15f82c22713
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.1.0-alpha.4"
        },
        {
            "introduced": "0.1.0-alpha.1"
        },
        {
            "fixed": "0.1.0-alpha.3"
        }
    ]
}

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-45091-35c40e22",
        "target": {
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/SealedEnv.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "188881187447561758743820035633489744836",
                "336904083728121644052334275076221642511",
                "170279412366793618156025653701605333188",
                "234838967746909808918845984402588165233",
                "123469576721254331092740891618199348121",
                "89818349868250875478260096886524855470",
                "282813438976443461777661692050624758626",
                "270634121123739753010133967150961007773",
                "140824201097010052696884153294943639133",
                "109697710036740471259656549839729144512",
                "299214820426976325161728260727986350734",
                "174869597651331265114943294305310917930",
                "171045538487025238495931947135851999351",
                "297516419299872602441325816362772937856",
                "156735690083949766592117701210098687299",
                "115977019313820928834999705805421660064",
                "43443187062030352139475204286736139225",
                "22856931956704028673132870136241914957",
                "31766565625935771479028468328627036032",
                "233585700440865786165863461804417679472",
                "263119331802547926476755120599810477016",
                "271348344011889988560448148188330248471",
                "258899558972464496800682453000505891120",
                "236708527225101934697285009390228351483",
                "324439031862068839593875031227969707771",
                "262152995922597517275236236207402738166",
                "264909676017154579910253941945819049529",
                "94547629297809959475680050692457451237",
                "127620769152151160832583510828772518130",
                "205737276059854123190291013088079159038",
                "205176707051853205409231353875403278238",
                "23737329048943006940277956638034815735",
                "2224498649669996485838161253035610169",
                "114663179832105039487883004981806432802"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-4b2b7102",
        "target": {
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/core/Constants.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "330200888487108824195689956743496493088",
                "199532804683821073528917094440028646096"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-544ef5ce",
        "target": {
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "13247261202124610410223510627751058843",
                "281277460267329991195855118615957167378",
                "48846643157429672032507719030310554099",
                "27938644784856205362307853584025084372",
                "32193784468893159513804098588757748039",
                "251420601572431773770835704813652879702",
                "60148198463075458661971321438568265120",
                "174338925732444461782920013255026574512",
                "94317373953788093839126781466747546234",
                "89806399091503487324665318604996314728",
                "297203169692114958452117436822390000835",
                "296956871944002992664191273798044009216",
                "56721633108974743668835192467127229981",
                "154843391947246177692530699270798417782",
                "183217348069011698710055808384669947228",
                "332181812313109790308994273690348835622",
                "279650193619213548691528566554504192163",
                "156868660347173991785282869740014871710",
                "133270379370247587635020975366377923017",
                "209089477676024347845878795237797522383",
                "195465698983719367973863602686606703035",
                "263721309623015149750098035513253598058",
                "304851150618928223663004993668136310391",
                "148798068759254222386255382124371742181",
                "152682270396643286718564600216361749000",
                "193838956030174758213647611483569588293",
                "319208262320710234035421435870635324567",
                "81117203626639996987070592911492991680",
                "248344984371084385734195654902843185355"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-5879926c",
        "target": {
            "function": "buildLines",
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileSerializer.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "336494405697154709024748615412278192753",
            "length": 1343.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-61f44e1f",
        "target": {
            "function": "javaReadsNodeEnterprise",
            "file": "java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/CrossStackInteropTest.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "66381944165735134889368618165384478816",
            "length": 1189.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-859f796c",
        "target": {
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/core/SealedFile.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "278023257536659517984509902935683670260",
                "74647698838468604742707060842101538369",
                "250836844305325199243442339070925596620",
                "104282813979521765069915126915729796681"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-8d5816dd",
        "target": {
            "file": "java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/SealedEnvSmokeTest.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "332263422883096282953213416426789107794",
                "104393929219236111310919790244034468306",
                "61255236545728094783096206726271728664",
                "255057980061850999751476979315904904857",
                "45617370978085238275595536383136210783",
                "120721166049796347920901239730949055157",
                "250307848356314871035514273327024393715",
                "52177444301053876782267532193917006118",
                "149209080048154189609498452167457998108",
                "183818085218423985328070604815060705427",
                "306184792453958442170910952223396037232",
                "232227520498220116455740602494441765428",
                "161455365662224529425048152421677569958"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-8dd86a45",
        "target": {
            "function": "buildVerifier",
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/SealedEnv.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "195952996593715240943191249806356708263",
            "length": 204.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-9926522a",
        "target": {
            "function": "seal",
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/SealedEnv.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "34221058470123240327219363293946325347",
            "length": 2425.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-b0cef873",
        "target": {
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileSerializer.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "273062080176185092833289301140208914367",
                "243927794944982961621390283865088330001",
                "115954213625582113753220011446668888898",
                "100044202797771119650763924654158096774",
                "79812079600684478388852687662513407836",
                "245443286852753430947941674041418924314"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-e5dfbb6f",
        "target": {
            "function": "fullFlow",
            "file": "java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/SealedEnvSmokeTest.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "18943209478305210840418413885571285821",
            "length": 1240.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-eb6c6311",
        "target": {
            "function": "wrongDeploy",
            "file": "java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/SealedEnvSmokeTest.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "53637275345875253716437651542168651665",
            "length": 1058.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-ec8145db",
        "target": {
            "file": "java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/CrossStackInteropTest.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76471615587512118210269853706327507833",
                "107904217315768886467400620210663747280",
                "156990627507805418634293463579006862124",
                "167163290737900021906204730098972842380",
                "126290926564932458758241818421196403823",
                "251318520103431318704314490083730297924",
                "115786357145849503187489967380375019651",
                "301796644533460025705529840869145030152",
                "305512410985222952804827271776157380927",
                "201167948448986102285473998707266220019",
                "99651913342732227105323769974603353592"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-f4265e08",
        "target": {
            "function": "build",
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "136127718405405258557957696080595265888",
            "length": 1294.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-f4f89012",
        "target": {
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileParser.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "2554788162895239441955965010449300338",
                "284260355048482751191764590615642299894",
                "56197518509085168573090123751624640243",
                "154130479779654479737523265802353319337",
                "213137691346536742329845639742062172068",
                "111726571316370291943768564762785218618",
                "49921977605751980408381099599260419235",
                "307183679349213191585311925640066452387",
                "180619663189895182532143136196345653563",
                "165257548181460490285888073475211491479",
                "265600015905426653689348039162197835420"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-45091-f82e07d4",
        "target": {
            "function": "parse",
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileParser.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "296285056119924006021662275357959018009",
            "length": 2954.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-45091-fd95284c",
        "target": {
            "function": "verify",
            "file": "java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "304444609074422301189720059906424054732",
            "length": 2862.0
        },
        "signature_version": "v1",
        "source": "https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713",
        "signature_type": "Function"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45091.json"
vanir_signatures_modified 
"2026-08-12T16:24:34Z"