{"id":"CVE-2026-45091","summary":"sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)","details":"sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.","aliases":["GHSA-x3r2-fj3r-g5mv"],"modified":"2026-08-12T16:24:34.802814Z","published":"2026-05-12T13:20:21.560Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200","CWE-522"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45091.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45091.json"},{"type":"ADVISORY","url":"https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45091"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/davidalmeidac/sealed-env","events":[{"introduced":"e8aabd3ff59321fe90416a03ae8e7cfa69a3ab60"},{"fixed":"b375bb137db4b075beeec7b6af59d15f82c22713"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.1.0-alpha.4"},{"introduced":"0.1.0-alpha.1"},{"fixed":"0.1.0-alpha.3"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45091.json","vanir_signatures_modified":"2026-08-12T16:24:34Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["188881187447561758743820035633489744836","336904083728121644052334275076221642511","170279412366793618156025653701605333188","234838967746909808918845984402588165233","123469576721254331092740891618199348121","89818349868250875478260096886524855470","282813438976443461777661692050624758626","270634121123739753010133967150961007773","140824201097010052696884153294943639133","109697710036740471259656549839729144512","299214820426976325161728260727986350734","174869597651331265114943294305310917930","171045538487025238495931947135851999351","297516419299872602441325816362772937856","156735690083949766592117701210098687299","115977019313820928834999705805421660064","43443187062030352139475204286736139225","22856931956704028673132870136241914957","31766565625935771479028468328627036032","233585700440865786165863461804417679472","263119331802547926476755120599810477016","271348344011889988560448148188330248471","258899558972464496800682453000505891120","236708527225101934697285009390228351483","324439031862068839593875031227969707771","262152995922597517275236236207402738166","264909676017154579910253941945819049529","94547629297809959475680050692457451237","127620769152151160832583510828772518130","205737276059854123190291013088079159038","205176707051853205409231353875403278238","23737329048943006940277956638034815735","2224498649669996485838161253035610169","114663179832105039487883004981806432802"],"threshold":0.9},"id":"CVE-2026-45091-35c40e22","signature_type":"Line","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/SealedEnv.java"}},{"source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/core/Constants.java"},"deprecated":false,"digest":{"line_hashes":["330200888487108824195689956743496493088","199532804683821073528917094440028646096"],"threshold":0.9},"id":"CVE-2026-45091-4b2b7102","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["13247261202124610410223510627751058843","281277460267329991195855118615957167378","48846643157429672032507719030310554099","27938644784856205362307853584025084372","32193784468893159513804098588757748039","251420601572431773770835704813652879702","60148198463075458661971321438568265120","174338925732444461782920013255026574512","94317373953788093839126781466747546234","89806399091503487324665318604996314728","297203169692114958452117436822390000835","296956871944002992664191273798044009216","56721633108974743668835192467127229981","154843391947246177692530699270798417782","183217348069011698710055808384669947228","332181812313109790308994273690348835622","279650193619213548691528566554504192163","156868660347173991785282869740014871710","133270379370247587635020975366377923017","209089477676024347845878795237797522383","195465698983719367973863602686606703035","263721309623015149750098035513253598058","304851150618928223663004993668136310391","148798068759254222386255382124371742181","152682270396643286718564600216361749000","193838956030174758213647611483569588293","319208262320710234035421435870635324567","81117203626639996987070592911492991680","248344984371084385734195654902843185355"],"threshold":0.9},"id":"CVE-2026-45091-544ef5ce","signature_type":"Line","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java"},"deprecated":false},{"id":"CVE-2026-45091-5879926c","signature_type":"Function","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileSerializer.java","function":"buildLines"},"deprecated":false,"digest":{"function_hash":"336494405697154709024748615412278192753","length":1343}},{"deprecated":false,"digest":{"function_hash":"66381944165735134889368618165384478816","length":1189},"id":"CVE-2026-45091-61f44e1f","signature_type":"Function","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/CrossStackInteropTest.java","function":"javaReadsNodeEnterprise"}},{"deprecated":false,"digest":{"line_hashes":["278023257536659517984509902935683670260","74647698838468604742707060842101538369","250836844305325199243442339070925596620","104282813979521765069915126915729796681"],"threshold":0.9},"id":"CVE-2026-45091-859f796c","signature_type":"Line","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/core/SealedFile.java"}},{"deprecated":false,"digest":{"line_hashes":["332263422883096282953213416426789107794","104393929219236111310919790244034468306","61255236545728094783096206726271728664","255057980061850999751476979315904904857","45617370978085238275595536383136210783","120721166049796347920901239730949055157","250307848356314871035514273327024393715","52177444301053876782267532193917006118","149209080048154189609498452167457998108","183818085218423985328070604815060705427","306184792453958442170910952223396037232","232227520498220116455740602494441765428","161455365662224529425048152421677569958"],"threshold":0.9},"id":"CVE-2026-45091-8d5816dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/SealedEnvSmokeTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/SealedEnv.java","function":"buildVerifier"},"deprecated":false,"digest":{"function_hash":"195952996593715240943191249806356708263","length":204},"id":"CVE-2026-45091-8dd86a45"},{"digest":{"function_hash":"34221058470123240327219363293946325347","length":2425},"id":"CVE-2026-45091-9926522a","signature_type":"Function","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/SealedEnv.java","function":"seal"},"deprecated":false},{"source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileSerializer.java"},"deprecated":false,"digest":{"line_hashes":["273062080176185092833289301140208914367","243927794944982961621390283865088330001","115954213625582113753220011446668888898","100044202797771119650763924654158096774","79812079600684478388852687662513407836","245443286852753430947941674041418924314"],"threshold":0.9},"id":"CVE-2026-45091-b0cef873","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"18943209478305210840418413885571285821","length":1240},"id":"CVE-2026-45091-e5dfbb6f","signature_type":"Function","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"function":"fullFlow","file":"java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/SealedEnvSmokeTest.java"}},{"source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/SealedEnvSmokeTest.java","function":"wrongDeploy"},"deprecated":false,"digest":{"function_hash":"53637275345875253716437651542168651665","length":1058},"id":"CVE-2026-45091-eb6c6311","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/test/java/io/github/davidalmeidac/sealedenv/CrossStackInteropTest.java"},"deprecated":false,"digest":{"line_hashes":["76471615587512118210269853706327507833","107904217315768886467400620210663747280","156990627507805418634293463579006862124","167163290737900021906204730098972842380","126290926564932458758241818421196403823","251318520103431318704314490083730297924","115786357145849503187489967380375019651","301796644533460025705529840869145030152","305512410985222952804827271776157380927","201167948448986102285473998707266220019","99651913342732227105323769974603353592"],"threshold":0.9},"id":"CVE-2026-45091-ec8145db"},{"id":"CVE-2026-45091-f4265e08","signature_type":"Function","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java","function":"build"},"deprecated":false,"digest":{"length":1294,"function_hash":"136127718405405258557957696080595265888"}},{"deprecated":false,"digest":{"line_hashes":["2554788162895239441955965010449300338","284260355048482751191764590615642299894","56197518509085168573090123751624640243","154130479779654479737523265802353319337","213137691346536742329845639742062172068","111726571316370291943768564762785218618","49921977605751980408381099599260419235","307183679349213191585311925640066452387","180619663189895182532143136196345653563","165257548181460490285888073475211491479","265600015905426653689348039162197835420"],"threshold":0.9},"id":"CVE-2026-45091-f4f89012","signature_type":"Line","signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileParser.java"}},{"signature_version":"v1","source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/format/SealedFileParser.java","function":"parse"},"deprecated":false,"digest":{"function_hash":"296285056119924006021662275357959018009","length":2954},"id":"CVE-2026-45091-f82e07d4","signature_type":"Function"},{"source":"https://github.com/davidalmeidac/sealed-env/commit/b375bb137db4b075beeec7b6af59d15f82c22713","target":{"file":"java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java","function":"verify"},"deprecated":false,"digest":{"function_hash":"304444609074422301189720059906424054732","length":2862},"id":"CVE-2026-45091-fd95284c","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}