Threat reportVulnerabilityTL-2026-0654
StrongDM Desktop CVE-2026-4387 — Plaintext Session State (JWT + Asymmetric Keypair) Enables Credential-less Cross-Host Session Hijack
StrongDM Desktop CVE-2026-4387 (TL-2026-0654), also tracked as StrongDM State File Reuse, is a high-severity software vulnerability scored CVSS 2, first published 2026-06-02. It has no confirmed attribution, affects StrongDM StrongDM Desktop Application, references 1 CVE (CVE-2026-4387), maps to 7 MITRE ATT&CK techniques (T1005, T1057, T1078), and is covered by 9 detection rules and 14 indicators of compromise.
- CVSS
- 2/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-0654
- Threat ID
- TL-2026-0654
- Also known as
- StrongDM State File Reuse, StrongDM state.kv Session Hijack
- Severity
- HIGH
- CVSS
- 2 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, financial-services, healthcare, government, saas
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in StrongDM Desktop CVE-2026-4387
Malware and tooling: Process Monitor (ProcMon), ROADTools - S0684, SharpDPAPI, curl
How StrongDM Desktop CVE-2026-4387 works
SpecterOps disclosed a cleartext-storage flaw (CWE-312 / CWE-522) in StrongDM's Windows desktop application: after authentication the full session material — a JWT plus a public/private asymmetric key pair — is written in plaintext to C:\Users\<username>\.sdm\state.kv, protected only by default user-level NTFS permissions. A local standard user can copy state.kv to an attacker-controlled host where, after launching StrongDM, the app auto-refreshes into a fully authenticated session as the victim — no password, phishing, host binding, or privilege escalation required, and reuse works on entirely external hosts.
CVE-2026-4387 is a cleartext credential-storage vulnerability (CWE-312 Cleartext Storage of Sensitive Information, also classified CWE-522 Insufficiently Protected Credentials) in the StrongDM desktop application on Windows, discovered by Hope Walker of SpecterOps and publicly disclosed on 2026-06-01.
DISCOVERY: SpecterOps began by examining files in StrongDM's per-user and program directories during a larger assessment. They first located what appeared to be authentication material in the application cache at C:\Users\<username>\AppData\Roaming\StrongDM\Cache\Cache_data\data_1 — a JSON response containing a JSON Web Token (JWT). Using Python with the ROADtools library (roadtx), they decoded the JWT, confirmed it was tied to the authenticated user, and identified the issuing endpoint. Process Monitor traces of the authentication flow then revealed repeated file interactions with C:\Users\<username>\.sdm\state.kv, identifying it as the durable credential-storage location.
ROOT CAUSE: After a user authenticates, StrongDM writes the complete session material to state.kv in plaintext: a JWT plus a public/private asymmetric key pair — together the full credential set required to establish an authenticated session. The file is protected only by default user-level NTFS permissions, so any local account with read access to the user profile can exfiltrate it without elevated privileges and without tripping privilege-escalation alerts.
LOCAL API SURFACE: The desktop app exposes a loopback API on http://127.0.0.1:65220. The /v2/authentication endpoint returned a valid authenticated JWT to any request that carried only the 'Sec-Fetch-Mode: no-cors' header while the app was running, and /v2/account disclosed the current StrongDM user context. SpecterOps verified hijacked sessions by querying these endpoints with curl.
EXPLOIT CHAIN (cross-host): (1) Authenticate StrongDM on HOST1 as USER1; (2) exfiltrate C:\Users\<USER1>\.sdm\state.kv; (3) install/launch StrongDM on attacker-controlled HOST2 (any user USER2); (4) replace HOST2's state.kv with the exfiltrated file — within seconds the app auto-refreshes and loads a fully authenticated session for USER1. Initial naive attempts to seed state.kv on a brand-new external host failed because the app cleared the file contents on first launch; the reliable method is to launch StrongDM FIRST on the target VM, then overwrite state.kv after launch, after which the app refreshes and loads the victim's resources. Hostname/domain impersonation proved unnecessary, and reuse succeeded on hosts entirely outside the original deployment environment. File-locking required multiple replacement attempts.
IMPACT & SEVERITY NOTE: The practical impact is full StrongDM session takeover — an attacker inherits the victim's privileged access to all systems brokered by StrongDM, with no priv-esc, no re-authentication, and no host binding. The CNA (StrongDM) assigned a CVSS 4.0 base score of 2.0 (LOW) (vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L), reflecting the local-access precondition and attack requirements. Threadlinqs assigns an editorial severity of HIGH because successful exploitation yields credential-less takeover of a privileged-access broker session that is portable to external infrastructure; defenders should weigh the business impact above the base CVSS.
REMEDIATION: StrongDM remediated on 2026-03-17 (fix deployed 2026-03-24) by moving credential storage to platform-native stores — Windows DPAPI and macOS Keychain. Post-fix, state.kv retains the public/private keys but no longer contains the JWT, and data_1 no longer stores the issued JWT. SpecterOps attempted to decrypt the DPAPI blobs with SharpDPAPI without success, and a retest on 2026-05-11 to 2026-05-14 against version 23.74.0 confirmed cross-host state-file reuse no longer yields an authenticated session. Fixed versions: Desktop 23.74.0+, CLI 53.77.0+. This is a local-access credential-storage flaw with no published network C2 IOCs.
MITRE ATT&CK techniques used in TL-2026-0654
Collection
Discovery
T1057 Process Discovery; T1083 File and Directory Discovery
Initial Access
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Lateral Movement
Affected products and versions in StrongDM Desktop CVE-2026-4387
- StrongDM — StrongDM Desktop Application
Vulnerable versions: < 23.74.0
Fixed in: 23.74.0 - StrongDM — StrongDM Desktop Client / CLI
Vulnerable versions: < 53.77.0
Fixed in: 53.77.0
Remediation for StrongDM Desktop CVE-2026-4387
Patches
- StrongDM Desktop Application 23.74.0 (Windows DPAPI / macOS Keychain credential storage)
- StrongDM CLI / Desktop Client 53.77.0
Immediate actions
- Update StrongDM Desktop to 23.74.0 or newer and CLI to 53.77.0 or newer on all Windows and macOS endpoints
- Treat any StrongDM session active on an unpatched build as potentially exposed: force re-authentication and rotate/revoke affected user sessions
- Hunt for copies of state.kv outside C:\Users\<username>\.sdm\ (email, file shares, USB, cloud sync, attacker staging dirs)
- Restrict NTFS ACLs on %USERPROFILE%\.sdm so only the owning user (not other local accounts) can read state.kv
Workarounds
- Harden NTFS permissions on the %USERPROFILE%\.sdm directory to deny read access to all but the owning principal
- Limit the number of local interactive accounts and local administrators on hosts running StrongDM
- Apply host egress controls to constrain exfiltration of the small state.kv file
Longer-term hardening
- Deploy EDR/file-integrity monitoring for read/copy access to C:\Users\*\.sdm\state.kv and the StrongDM cache data_1 file
- Alert on non-StrongDM processes accessing the loopback API at 127.0.0.1:65220 (/v2/authentication, /v2/account)
- Enforce device-bound / hardware-backed session binding for privileged-access brokers where supported
- Baseline and monitor for StrongDM authenticated sessions appearing from unexpected hosts, geographies, or device fingerprints
CVEs associated with StrongDM Desktop CVE-2026-4387
Weaknesses (CWE) in StrongDM Desktop CVE-2026-4387
Timeline of StrongDM Desktop CVE-2026-4387
- SpecterOps began investigating the StrongDM desktop application during a larger assessment, examining files in the StrongDM user and program directories.
- SpecterOps (Hope Walker) filed a vulnerability report with StrongDM via HackerOne.
- StrongDM acknowledged the HackerOne report.
- StrongDM categorized the severity of the reported issue.
- The HackerOne report was closed.
- SpecterOps re-filed the report on Bugcrowd to continue coordination.
- Bugcrowd erroneously closed the report as a duplicate.
- StrongDM reopened the report after further communication with the researcher.
- Regular update communications were established between SpecterOps and StrongDM.
- StrongDM remediated the vulnerability, moving credential storage to Windows DPAPI and macOS Keychain; JWT no longer written to state.kv in recoverable form.
- Fix deployed for Windows and macOS (Desktop 23.74.0, CLI 53.77.0).
- SpecterOps began retesting against version 23.74.0 to confirm remediation.
- Retest confirmed cross-host state-file reuse no longer yields an authenticated session; SharpDPAPI decryption of the new DPAPI blobs was unsuccessful.
- CVE-2026-4387 reserved.
- CVE-2026-4387 published; StrongDM CNA assigned CVSS 4.0 base score 2.0 (LOW).
- SpecterOps publicly disclosed the vulnerability with full technical writeup of the state-file reuse exploit chain.
Sources cited for StrongDM Desktop CVE-2026-4387
Detection coverage for TL-2026-0654
As of 2026-06-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0654 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.