Microsoft · Windows · CVE-2026-4387
**Name of the Vulnerable Software and Affected Versions**
StrongDM Desktop Application versions prior to 23.74.0
StrongDM Desktop Client versions prior to 53.77.0
**Description**
On Microsoft Windows, the software stores authentication state in cleartext within a per-user state file located at "C:Users<username>.sdmstate.kv". This file contains a JSON Web Token (JWT) and asymmetric RSA key material, protected only by default user-level NTFS permissions. An attacker with local read access to the user's profile directory can exfiltrate this file and deploy it on another host to hijack sessions and gain authenticated access to infrastructure resources without needing credentials. Additionally, the local endpoint "http://127.0.0.1:65220/v2/authentication" leaked JWTs.
**Recommendations**
Update StrongDM Desktop Application to version 23.74.0 or later.
Update StrongDM Desktop Client to version 53.77.0 or later.