CVE-2026-45091 sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Attackers can extract plaintext TOTP secrets from unseal tokens in enterprise mode, bypassing two-factor authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45091?
CVE-2026-45091 is a critical vulnerability in davidalmeidac sealed-env, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.
Which versions are affected by CVE-2026-45091?
4 open source packages ship an affected version, including io.github.davidalmeidac:sealed-env-core and sealed-env.
| Package | Affected | Fixed in |
|---|---|---|
io.github.davidalmeidac:sealed-env-core Maven | All versions | 0.1.0-alpha.4 |
io.github.davidalmeidac:sealed-env-core Maven | All versions | 0.1.0-alpha.4 |
sealed-env npm | All versions | 0.1.0-alpha.4 |
sealed-env npm | All versions | 0.1.0-alpha.4 |
How do I fix CVE-2026-45091?
Upgrade io.github.davidalmeidac:sealed-env-core to 0.1.0-alpha.4 or later.
Is CVE-2026-45091 being exploited?
There is no known exploitation of CVE-2026-45091 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-x3r2-fj3r-g5mv.