9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45091

CVE-2026-45091: sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45091

CVE-2026-45091:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sealed-env	npm	< 0.1.0-alpha.4	0.1.0-alpha.4
io.github.davidalmeidac:sealed-env-core	maven	< 0.1.0-alpha.4	0.1.0-alpha.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the sealed-env library's enterprise mode, where the Time-based One-Time Password (TOTP) secret was embedded in plaintext (base64 encoded) within the JWS payload of unseal tokens. This allows any party with access to a token (e.g., from CI logs, container environment dumps) to decode the payload and retrieve the TOTP secret. The analysis of the patch commit reveals the exact functions responsible for this behavior.

The primary vulnerable functions are io.github.davidalmeidac.sealedenv.totp.UnsealToken.build in the Java implementation and buildUnsealToken in the Node.js implementation. These functions were responsible for constructing the JWS token and directly inserting the totpSecret into the payload. The patch replaces this with a salt-bound HMAC derivative (enterprise_epoch), ensuring the actual secret never leaves the operator's machine.

Other functions like seal and verify in both Java and Node.js were also identified as part of the vulnerable process. The seal functions were involved in creating a verifier from the raw secret, and the verify functions were responsible for extracting the secret from the token, confirming its presence. The patch modifies these functions to work with the new epochCommit and epoch fields, removing any handling of the raw TOTP secret in the tokenization process.

Vulnerable functions

io.github.davidalmeidac.sealedenv.totp.UnsealToken.build

java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java

This function builds the JWS unseal token and, in the vulnerable versions, it directly embeds the base64-encoded TOTP secret into the token's payload. This payload is not encrypted, allowing anyone who can view the token to decode the secret.

buildUnsealToken

node/src/totp/unsealToken.ts

This function is the Node.js equivalent of the vulnerable Java function. It constructs the JWS unseal token and embeds the base64-encoded TOTP secret directly into the token's payload, which is not encrypted.

io.github.davidalmeidac.sealedenv.SealedEnv.seal

java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/SealedEnv.java

The `seal` function orchestrates the creation of the sealed file. In vulnerable versions, it calls a helper (`buildVerifier`) that operates on the raw TOTP secret to create a verifier. This is part of the flawed design where the secret is handled directly and subsequently leaked into the unseal token during the unsealing process's token generation step.

seal

node/src/core/api.ts

The Node.js `seal` function, like its Java counterpart, is involved in the vulnerable process. It computes a `totpVerifier` from the raw TOTP secret, which is part of the overall insecure design that leads to the secret being embedded in the unseal token.

io.github.davidalmeidac.sealedenv.totp.UnsealToken.verify

java/sealed-env-core/src/main/java/io/github/davidalmeidac/sealedenv/totp/UnsealToken.java

This function is responsible for verifying the unseal token. In doing so, it decodes the `totp_secret` directly from the token's payload, demonstrating that the secret was present and accessible within the token.

verifyUnsealToken

node/src/totp/unsealToken.ts

The Node.js `verifyUnsealToken` function shows the other side of the vulnerability. It reads the base64-encoded `totp_secret` from the unseal token's payload, confirming that the secret was exposed in the token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.