StrongDM Desktop Client vulnerabilities

Latest StrongDM Desktop Client CVEs

Newest publication first

1. CVE-2026-4387 Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file

   Published 2026-05-29

   Low·CVSS 2.0 EPSS 0.13%

   StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users<username>.sdm\state.kv. The file is prot...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.