What is the CVSS score of CVE-2026-45091?

CVE-2026-45091 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of sealed-env are affected by CVE-2026-45091?

CVE-2026-45091 exposes TOTP operator authentication credentials in plaintext within sealed-env enterprise mode tokens (versions 0.1.0-alpha.1 through 0.1.0-alpha.3), allowing unauthenticated…. A patch is available.

Is there a public PoC exploit available for CVE-2026-45091?

Yes, a public proof-of-concept exploit is available for CVE-2026-45091. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-45091?

Within 24 hours: Identify all sealed-env deployments and audit version numbers to determine exposure scope; immediately isolate or quarantine affected systems. Within 7 days: Upgrade to sealed-env version 0.1.0-alpha.4 or later; rotate all TOTP operator credentials and invalidate previously-issued unseal tokens. Within 30 days: Conduct full audit of CI logs, container registries, and log aggregators for exposed tokens; review operator access logs for unauthorized authentication attempts; implement token encryption and log redaction controls.

sealed-env CVE-2026-45091

EUVD-2026-29476 CRITICAL

Information Exposure (CWE-200)

2026-05-12 GitHub_M

GHSA-x3r2-fj3r-g5mv

Information Disclosure Java Node.js

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 12, 2026 - 15:02 EUVD

Analysis Generated

May 12, 2026 - 14:15 vuln.today

CVE Published

May 12, 2026 - 13:20 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on io.github.davidalmeidac:sealed-env-core (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.1.0-alpha.4.

DescriptionGitHub Advisory

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.

Articles & Coverage 1

POC CVE-2026-45091: TOTP Secret Leaked in JWT Payload via sealed-env May 16, 2026

AnalysisAI

Plaintext TOTP secret exposure in sealed-env enterprise mode allows remote unauthenticated attackers to extract operator authentication credentials from base64-decoded JWS tokens. Versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embed literal TOTP secrets in every minted unseal token's JWS payload without encryption, enabling credential harvesting from CI logs, container environments, monitoring tools, and log aggregators. Fixed in version 0.1.0-alpha.4. CVSS 9.1 (Critical) with network vector and no authentication required. No CISA KEV listing or public exploit code identified at time of analysis, but exploitation requires only base64 decoding of observable tokens.

Technical ContextAI

sealed-env is a cross-stack secret management library for Node.js and Java/Spring Boot environments implementing zero-trust principles. JWS (JSON Web Signature) tokens use base64url-encoded JSON payloads that are cryptographically signed but NOT encrypted - the payload remains readable to anyone with the token. TOTP (Time-based One-Time Password) secrets are cryptographic seeds used to generate authentication codes; exposure of the TOTP secret allows attackers to generate valid authentication tokens indefinitely until the secret is rotated. This vulnerability represents CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), specifically cleartext storage of credentials in a signed-but-unencrypted data structure. The affected CPE (cpe:2.3:a:davidalmeidac:sealed-env) indicates this impacts the davidalmeidac implementation across both Node.js and Java/Spring Boot platforms when operating in enterprise mode.

RemediationAI

Upgrade sealed-env to version 0.1.0-alpha.4 or later immediately, as this version removes TOTP secret embedding from JWS payloads per the vendor security advisory at https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv. After upgrading, MANDATORY follow-up actions: (1) Rotate all TOTP secrets for operators who used affected versions - compromised secrets remain valid indefinitely until changed. (2) Audit historical logs, CI/CD build outputs, monitoring platform archives, and error tracking systems for exposed tokens containing TOTP secrets; purge or redact these records. (3) Review authentication logs for unauthorized access using potentially compromised TOTP credentials. If immediate upgrade is impossible, emergency compensating controls include: disabling sealed-env enterprise mode and reverting to basic mode (eliminates TOTP token generation but reduces functionality), implementing network segmentation to restrict token observation points (reduces exposure surface but does not eliminate risk from legitimate monitoring tools), and implementing runtime secrets scanning to detect base64-encoded TOTP patterns in logs (detection-only, does not prevent initial exposure). All workarounds are temporary mitigations with significant operational trade-offs; only upgrading and credential rotation fully resolves the vulnerability.