EUVD-2026-33417
GHSA-qgjm-4mg2-6wm5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (StrongDM) · only source for this CVE.
CVSS VectorVendor: StrongDM
Lifecycle Timeline
4DescriptionCVE.org
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions.
Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host.
The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).
AnalysisAI
StrongDM Desktop Application on Microsoft Windows exposes authentication secrets - including JSON Web Tokens and asymmetric key material - by writing them in cleartext to C:\Users\<username>\.sdm\state.kv, a per-user state file protected solely by default NTFS user-level permissions. Versions prior to Desktop Application 23.74.0 and Desktop Client 53.77.0 are affected. A local attacker meeting the required access prerequisites could read this file and extract live credentials, potentially enabling impersonation of the victim against StrongDM-managed infrastructure. No public exploit code exists and the vulnerability is not in the CISA KEV catalog; the low CVSS 4.0 score of 2.0 reflects the constrained local attack surface and required attack conditions.
Technical ContextAI
The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information), a design-level defect where sensitive authentication material is persisted to disk without encryption. The affected artifacts are a JSON Web Token - used for session authentication - and asymmetric key material, both stored in a key-value flat file at a predictable, user-scoped path on Windows. The NTFS permission model offers file-level isolation between user accounts under normal conditions, but provides no cryptographic protection; any process or account with read access to the victim's profile can trivially open and parse the file. CPE data identifies both cpe:2.3:a:strongdm:strongdm_desktop_application and cpe:2.3:a:strongdm:strongdm_desktop_client as distinct affected packages. The CVSS 4.0 vector element AT:P (Attack Requirements: Present) indicates the exploit path depends on specific deployment or execution conditions on the host beyond mere local access, though these conditions are not fully enumerated in the advisory.
RemediationAI
Upgrade StrongDM Desktop Application to version 23.74.0 or later and StrongDM Desktop Client to version 53.77.0 or later, as confirmed by the vendor advisory at https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed. The patch is confirmed available from StrongDM. If immediate upgrade is not possible, apply tightened NTFS ACLs on C:\Users\<username>\.sdm\ to deny read access to all accounts other than the owning user and SYSTEM - note this may interfere with backup agents or endpoint security tools that traverse user profiles. As an additional compensating control, consider rotating any JWT sessions and rekeying asymmetric credentials for users on systems believed to have been accessed by unauthorized local accounts, since the cleartext material may have already been read. Organizations should also audit Windows endpoints for shared local administrator accounts that could bypass user-level NTFS protections. No side effects from upgrading to 23.74.0 or 53.77.0 are identified in available data.
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today