Critical StrongDM Flaw Exposes Users to Authentication Token Theft and Reuse

A critical security vulnerability tracked as CVE-2026-4387 has been disclosed in StrongDM, allowing attackers to steal and reuse authentication tokens to gain unauthorized access to infrastructure.

The issue, discovered by SpecterOps researcher Hope Walker, affects StrongDM desktop and CLI environments before the patched versions and poses significant risks to enterprise environments that rely on centralized access control.

StrongDM Flaw Exposes Users

The vulnerability stems from how StrongDM previously handled authentication data. After a user successfully logged into the StrongDM desktop application, sensitive session data was stored locally in a file named state.kv, located in the user directory at C:\Users<username>.sdm\state.kv.

This file contained a JSON Web Token (JWT) along with a public and private key pair, all stored in plaintext.

SpecterOps found that this state file could be copied and reused across systems to impersonate authenticated users. An attacker with user-level access could exfiltrate the state.Copy the KV file from a compromised machine and place it on another system. Once the StrongDM application loaded the file, it would automatically grant access as the original user without requiring reauthentication.

In practical terms, this means that attackers did not need credentials, multi-factor authentication, or direct interaction with identity providers. Simply possessing the state file was sufficient to hijack active sessions and access protected resources such as databases, servers, or cloud infrastructure managed via StrongDM.

Further analysis revealed that the JWT could also be retrieved locally through an internal endpoint (http://127.0.0.1:65220/v2/authentication) using minimal request headers. This made token extraction even easier during an active session. Combined with the exposed key pair in the state file, the attack enabled full session replay capabilities.

One notable aspect of the research was that the attack worked not only within the same environment but also across external systems. Even when initial protections appeared to clear the state file, attackers could reliably bypass this by replacing the file after launching the application, allowing session takeover on completely different hosts.

The root cause lies in the insecure storage of authentication material and the lack of binding between session tokens and specific devices. Since only standard user permissions were required to access the file, the attack significantly lowered the barrier for exploitation, especially in post-compromise scenarios.

StrongDM addressed the issue in Desktop version 23.74.0 and CLI version 53.77.0. The fix replaces plaintext storage with platform-native secure storage mechanisms such as Windows DPAPI and macOS Keychain. After remediation, the state.kv file no longer contains JWT tokens, preventing reuse attacks even if the file is stolen.

Security teams are strongly advised to update all StrongDM clients immediately and monitor for suspicious access patterns. Additionally, restricting local file access, enforcing endpoint security controls, and auditing session behavior can help reduce exposure to similar token replay attacks.

This vulnerability highlights the critical importance of secure credential storage. It reinforces that even local session artifacts can become high-impact attack vectors if improperly protected.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.