# StrongDM Desktop CVE-2026-4387 — Plaintext Session State (JWT + Asymmetric Keypair) Enables Credential-less Cross-Host Session Hijack

> SpecterOps disclosed a cleartext-storage flaw (CWE-312 / CWE-522) in StrongDM's Windows desktop application: after authentication the full session material — a JWT plus a public/private asymmetric key pair — is written in plaintext to C:\Users\<username>\.sdm\state.kv, protected only by default user-level NTFS permissions. A local standard user can copy state.kv to an attacker-controlled host where, after launching StrongDM, the app auto-refreshes into a fully authenticated session as the victim — no password, phishing, host binding, or privilege escalation required, and reuse works on entirely external hosts.

- **Published:** 2026-06-02T00:00:00Z
- **Last reviewed:** 2026-06-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0654
- **ID:** TL-2026-0654
- **Severity:** HIGH (CVSS 2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-4387

## Description

CVE-2026-4387 is a cleartext credential-storage vulnerability (CWE-312 Cleartext Storage of Sensitive Information, also classified CWE-522 Insufficiently Protected Credentials) in the StrongDM desktop application on Windows, discovered by Hope Walker of SpecterOps and publicly disclosed on 2026-06-01.

DISCOVERY: SpecterOps began by examining files in StrongDM's per-user and program directories during a larger assessment. They first located what appeared to be authentication material in the application cache at C:\Users\<username>\AppData\Roaming\StrongDM\Cache\Cache_data\data_1 — a JSON response containing a JSON Web Token (JWT). Using Python with the ROADtools library (roadtx), they decoded the JWT, confirmed it was tied to the authenticated user, and identified the issuing endpoint. Process Monitor traces of the authentication flow then revealed repeated file interactions with C:\Users\<username>\.sdm\state.kv, identifying it as the durable credential-storage location.

ROOT CAUSE: After a user authenticates, StrongDM writes the complete session material to state.kv in plaintext: a JWT plus a public/private asymmetric key pair — together the full credential set required to establish an authenticated session. The file is protected only by default user-level NTFS permissions, so any local account with read access to the user profile can exfiltrate it without elevated privileges and without tripping privilege-escalation alerts.

LOCAL API SURFACE: The desktop app exposes a loopback API on http://127.0.0.1:65220. The /v2/authentication endpoint returned a valid authenticated JWT to any request that carried only the 'Sec-Fetch-Mode: no-cors' header while the app was running, and /v2/account disclosed the current StrongDM user context. SpecterOps verified hijacked sessions by querying these endpoints with curl.

EXPLOIT CHAIN (cross-host): (1) Authenticate StrongDM on HOST1 as USER1; (2) exfiltrate C:\Users\<USER1>\.sdm\state.kv; (3) install/launch StrongDM on attacker-controlled HOST2 (any user USER2); (4) replace HOST2's state.kv with the exfiltrated file — within seconds the app auto-refreshes and loads a fully authenticated session for USER1. Initial naive attempts to seed state.kv on a brand-new external host failed because the app cleared the file contents on first launch; the reliable method is to launch StrongDM FIRST on the target VM, then overwrite state.kv after launch, after which the app refreshes and loads the victim's resources. Hostname/domain impersonation proved unnecessary, and reuse succeeded on hosts entirely outside the original deployment environment. File-locking required multiple replacement attempts.

IMPACT & SEVERITY NOTE: The practical impact is full StrongDM session takeover — an attacker inherits the victim's privileged access to all systems brokered by StrongDM, with no priv-esc, no re-authentication, and no host binding. The CNA (StrongDM) assigned a CVSS 4.0 base score of 2.0 (LOW) (vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L), reflecting the local-access precondition and attack requirements. Threadlinqs assigns an editorial severity of HIGH because successful exploitation yields credential-less takeover of a privileged-access broker session that is portable to external infrastructure; defenders should weigh the business impact above the base CVSS.

REMEDIATION: StrongDM remediated on 2026-03-17 (fix deployed 2026-03-24) by moving credential storage to platform-native stores — Windows DPAPI and macOS Keychain. Post-fix, state.kv retains the public/private keys but no longer contains the JWT, and data_1 no longer stores the issued JWT. SpecterOps attempted to decrypt the DPAPI blobs with SharpDPAPI without success, and a retest on 2026-05-11 to 2026-05-14 against version 23.74.0 confirmed cross-host state-file reuse no longer yields an authenticated session. Fixed versions: Desktop 23.74.0+, CLI 53.77.0+. This is a local-access credential-storage flaw with no published network C2 IOCs.

## MITRE ATT&CK

- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts

## Sources

- [SpecterOps — CVE-2026-4387: StrongDM State File Reuse](https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/)
- [Critical StrongDM Vulnerability Enables Authentication Theft](https://cyberpress.org/critical-strongdm-vulnerability/)
- [CVE-2026-4387 — CIRCL Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/cve-2026-4387)
- [CVE-2026-4387 — THREATINT](https://cve.threatint.eu/CVE/CVE-2026-4387)
- [NVD — CVE-2026-4387](https://nvd.nist.gov/vuln/detail/CVE-2026-4387)
- [MITRE CVE Record — CVE-2026-4387](https://www.cve.org/CVERecord?id=CVE-2026-4387)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0654