StrongDM Desktop Application stores a JSON Web Token and asymmetric key material in cleartext within the user's state.kv file. If an attacker can read the target user’s profile directory, they can retrieve both the token and the key material, which may enable authentication as that user or further credential theft. The vulnerability exemplifies insecure storage (CWE‑312) and inadequate protection of credentials (CWE‑522).

StrongDM Desktop Application and Desktop Client on Microsoft Windows versions prior to 23.74.0 and 53.77.0 respectively. The vulnerable file is located at C:\Users\<username>\.sdm\state.kv and is protected only by default user‑level NTFS permissions.

The CVSS score of 2 indicates low severity. The EPSS score is not available, suggesting a low probability of exploitation. The flaw can only be leveraged by users who have local read access to the victim’s profile and who meet the deployment and execution conditions described by the vendor. It is not catalogued in the CISA KEV list, so it has not been linked to known large‑scale attacks, yet local compromise of the token can lead to significant credential misuse.