Pi: Race condition in auth.json writes could expose stored credentials

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54327 · Microsoft / collected KEV context

EUVD-2026-38582

GHSA-r95r-rj6r-c39x

cve-program · CVE-2026-54327

• https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x
• https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347
• https://github.com/earendil-works/pi/releases/tag/v0.78.1

euvd · EUVD-2026-38582

• https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x
• https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347
• https://github.com/earendil-works/pi/releases/tag/v0.78.1

nvd · CVE-2026-54327

• https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347
• https://github.com/earendil-works/pi/releases/tag/v0.78.1
• https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x

osv · GHSA-r95r-rj6r-c39x

• https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x
• https://nvd.nist.gov/vuln/detail/CVE-2026-54327
• https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347
• https://github.com/earendil-works/pi
• https://github.com/earendil-works/pi/releases/tag/v0.78.1

No related operational record is retained in the current change model.