{"id":"EUVD-2026-29476","enisaUuid":"23c12450-9d00-30c4-ab18-2afdca450d95","description":"sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator\u0027s literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.","datePublished":"May 12, 2026, 1:20:21 PM","dateUpdated":"May 12, 2026, 2:39:10 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv\n","aliases":"CVE-2026-45091\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"f5f9b612-fbbc-30bb-a41b-a4a0e3d3e412","product":{"name":"sealed-env","vendor":{"name":"davidalmeidac"}},"product_version":"\u003c 0.1.0-alpha.4"}],"enisaIdVendor":[{"id":"87a7ee18-a26a-3e40-a94b-6f33989fec0c","vendor":{"name":"davidalmeidac"}}],"enisaIdVulnerability":[{"id":"10940a57-cf2c-3cb9-9fe5-371e783c6cc5","vulnerability":{"id":"GHSA-x3r2-fj3r-g5mv","description":"sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)","datePublished":"May 12, 2026, 3:09:08 PM","dateUpdated":"May 13, 2026, 4:24:37 PM","baseScore":0.0,"references":"https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45091\nhttps://github.com/davidalmeidac/sealed-env\n","enisa_id":"EUVD-2026-29476\n","aliases":"GHSA-x3r2-fj3r-g5mv\nCVE-2026-45091\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4030c822-5700-3d0e-a8d6-0c5ee56ade59","vulnerability":{"id":"CVE-2026-45091","description":"sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator\u0027s literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.","datePublished":"May 12, 2026, 1:20:21 PM","dateUpdated":"May 12, 2026, 2:39:10 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv\n","enisa_id":"EUVD-2026-29476\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 3, 2026, 7:17:32 AM","vulnerabilityProduct":[{"id":"ed72ce2e-faa3-38d0-a4da-f4453bdb2f17","product":{"name":"sealed-env","vendor":{"name":"davidalmeidac"}},"product_version":"\u003c 0.1.0-alpha.4"}],"vulnerabilityVendor":[{"id":"1b450257-575c-36e3-8d21-1c5d961b1bf0","vendor":{"name":"davidalmeidac"}}]}}],"enisaIdAdvisory":[]}