CVE-2026-45091, CoreCVE

Back Back to CVE browser

CRITICAL

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

Published May 12, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.40%

Description

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.

Affected products

Vendor Davidalmeidac Product Sealed-Env Default
n/a
- Version
  < 0.1.0-alpha.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Davidalmeidac

Sealed-Env

n/a

Version	Status	Constraints
< 0.1.0-alpha.4	affected	-

sealed-env

npm

Introduced 0 Fixed 0.1.0-alpha.4
io.github.davidalmeidac:sealed-env-core

Maven

Introduced 0 Fixed 0.1.0-alpha.4

Ecosystem	Package	Introduced	Fixed
npm	sealed-env	0	0.1.0-alpha.4
Maven	io.github.davidalmeidac:sealed-env-core	0	0.1.0-alpha.4

Remediation

No remediation recorded yet.

Metrics

0.40% 0.00404

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00404

Score over time

May–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.40% (0.00404)	32.29th	v5 (v2026.06.15)
Jun 15, 2026	0.32% (0.00319)	23.45th	v5 (v2026.06.15)
May 13, 2026	0.01% (0.00011)	1.33th	v4 (v2025.03.14)

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-522

Insufficiently Protected Credentials

References (3)

https://github.com/advisories/GHSA-x3r2-fj3r-g5mv
Advisory
https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-45091

Link	Providers	Tags
https://github.com/advisories/GHSA-x3r2-fj3r-g5mv		Advisory
https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-45091