Critical StrongDM CVE-2024-2495 Allows Auth Token Theft and Reuse

Key Takeaways

• A severe authentication vulnerability (CVE-2026-4387) was discovered in StrongDM’s desktop applications.
• The flaw allowed attackers with local system access to steal and reuse authentication tokens, enabling full session hijacking without requiring user credentials.
• The vulnerability stemmed from plaintext storage of session data, including JWTs and cryptographic keys, in a file accessible with user-level permissions.
• StrongDM has released patches in Desktop version 23.74.0 and CLI version 53.77.0, which remediate the issue by implementing secure, platform-native storage mechanisms.
• All StrongDM users are urged to update their clients immediately to protect against potential exploitation.

A critical security vulnerability has been identified in the StrongDM desktop application, posing a significant risk of session hijacking for enterprise users. Discovered by researchers at SpecterOps, the flaw, designated as CVE-2026-4387, allowed attackers to extract and reuse authentication tokens stored locally, thereby gaining unauthorized access to sensitive infrastructure managed through StrongDM.

Deep Dive into CVE-2026-4387

The core of the vulnerability lay in StrongDM’s method of storing session data on the local disk. Following a successful user login, the application would save critical authentication material within a file named .sdmstate.kv, located in the user’s directory (e.g., C:Users<username>.sdmstate.kv). This file contained a JSON Web Token (JWT) along with a public and private key pair, all stored in an unencrypted, plaintext format.

Since the .sdmstate.kv file only required standard user-level permissions for access, an attacker who had already achieved system-level access to a compromised machine could easily retrieve this file without needing elevated privileges. SpecterOps demonstrated that this extracted state file could then be transplanted to another machine, allowing the StrongDM client on the new host to automatically authenticate as the legitimate user without any password or MFA challenges.

Exploitation and Impact

The attack scenario involved copying the KV state file from a compromised system to a different host. By replacing this file, even after the StrongDM application had launched, attackers could bypass typical startup-file protections and leverage the victim’s session. This method effectively allowed for full session hijacking, enabling unauthorized access to databases, servers, and cloud resources managed via StrongDM. The lack of proper binding between the session tokens and the original host environment was a key enabler for this cross-system reuse.

Further analysis by SpecterOps revealed additional weaknesses, including a local endpoint at http://127.0.0.1:65220/v2/authentication that exposed JWT tokens when queried with minimal headers, and cached files like data_1 that also held sensitive authentication data. The ease of exploitation, requiring only user-level permissions, significantly lowers the barrier for adversaries, making it particularly dangerous in post-compromise scenarios where an attacker might already have a foothold within an organization’s network.

Remediation and Disclosure Timeline

StrongDM has addressed this critical flaw by fundamentally changing how sensitive authentication data is stored. The updated versions no longer store plaintext authentication material. Instead, they leverage platform-native secure storage mechanisms, such as DPAPI (Data Protection API) on Windows and Keychain on macOS. Furthermore, JWTs are no longer retained within the state.kv file, preventing their reuse across different systems. Security validation confirmed that transferring session files between hosts no longer grants authenticated access.

The vulnerability was initially reported to StrongDM in May 2025. A fix was subsequently implemented in March 2026. According to SpecterOps, public disclosure of CVE-2026-4387 occurred on May 29, 2026, with a broader disclosure following on June 1, 2026.

What You Should Do

• Immediately Update: All users of StrongDM Desktop and CLI applications must update to the patched versions. Specifically, StrongDM Desktop version 23.74.0 and StrongDM CLI version 53.77.0 or newer.
• Review Access Controls: Ensure strict access controls are in place for user directories and sensitive files on endpoints where StrongDM clients are installed.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for suspicious activity, such as unauthorized access to application state files or unusual network connections from StrongDM client processes.
• Educate Users: Reinforce best practices for endpoint security and the importance of timely software updates to prevent local exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.