--- title: CVE-2026-4387: StrongDM State File Reuse | daily.dev description: SpecterOps disclosed CVE-2026-4387, a vulnerability in the StrongDM desktop application where authentication material, including a JWT and public/private key... canonical: https://daily.dev/posts/cve-2026-4387-strongdm-state-file-reuse-mguy2ohhb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-4387: StrongDM State File Reuse | daily.dev og:description: SpecterOps disclosed CVE-2026-4387, a vulnerability in the StrongDM desktop application where authentication material, including a JWT and public/private key... og:url: https://daily.dev/posts/cve-2026-4387-strongdm-state-file-reuse-mguy2ohhb og:image: https://api.daily.dev/og/posts/mGUY2Ohhb.png og:image:alt: CVE-2026-4387: StrongDM State File Reuse og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-4387: StrongDM State File Reuse **[SpecterOps](https://daily.dev/sources/specterops)** · 9 min read · 0 upvotes · 0 comments ## Summary SpecterOps disclosed CVE-2026-4387, a vulnerability in the StrongDM desktop application where authentication material, including a JWT and public/private key pair, was stored in plaintext in a state.kv file. Attackers with only user-level permissions could copy this file to another host and gain an authenticated session for the original user, even outside the original environment, by relaunching the StrongDM desktop app after replacing the file. StrongDM remediated the issue in Desktop version 23.74.0 and CLI version 53.77.0 by switching to platform-native credential storage (macOS Keychain, DPAPI) instead of plaintext storage. The disclosure timeline spanned from initial discovery in May 2025 to public disclosure in June 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-4387 in StrongDM and how does the state file reuse attack work? CVE-2026-4387 is a StrongDM desktop vulnerability where authentication material, including a JWT and a public/private key pair, was stored in plaintext in a state.kv file at C:\Users\\.sdm\state.kv. An attacker with only user-level permissions could copy this file to another host, replace the local state.kv, and relaunch StrongDM to gain an authenticated session as the original user, including on hosts outside the original environment. _Track disclosures like this StrongDM CVE alongside other vendor advisories on daily.dev._ ### How was the StrongDM state file reuse vulnerability fixed and what version should I update to? StrongDM fixed CVE-2026-4387 by moving credential storage to platform-native mechanisms, macOS Keychain and Windows DPAPI, instead of storing the JWT in plaintext inside state.kv. The fix shipped in Desktop version 23.74.0 and CLI version 53.77.0, implemented on March 17, 2026 for the core fix and March 24, 2026 for the CLI. Testing in May 2026 confirmed moving state files between hosts no longer grants an authenticated session. _daily.dev helps teams stay on top of patch versions before an unpatched CVE gets exploited._ ### What local endpoint did the StrongDM desktop application expose for authentication and how was it discovered? The StrongDM desktop application exposed a local endpoint at http://127.0.0.1:65220/v2/authentication that returned the authenticated user's JWT when queried with a request containing only the Sec-Fetch-Mode: no-cors header, using curl.exe since Burp could not intercept it. A related endpoint, http://127.0.0.1:65220/v2/account, disclosed the currently authenticated account name. _Researchers reverse-engineering local app endpoints can follow similar security writeups on daily.dev._ ## Similar posts on daily.dev - [You Can't Leak a Key You Never Held](https://daily.dev/posts/you-can-t-leak-a-key-you-never-held-v4tv2u8ax) · strongdm · 0 upvotes · 0 comments - [CVE-2026-2699-and-CVE-2026-2701](https://daily.dev/posts/cve-2026-2699-and-cve-2026-2701-h1dmpcfo8) · Arctic Wolf · 0 upvotes · 0 comments - [Certighost and the Privilege Hiding in Your Certificate Authority](https://daily.dev/posts/certighost-and-the-privilege-hiding-in-your-certificate-authority-8opcdovjc) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#vulnerability](https://daily.dev/tags/vulnerability), [#strongdm](https://daily.dev/tags/strongdm) [View this post on daily.dev](https://daily.dev/posts/cve-2026-4387-strongdm-state-file-reuse-mguy2ohhb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-4387: StrongDM State File Reuse","url":"https://daily.dev/posts/cve-2026-4387-strongdm-state-file-reuse-mguy2ohhb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-4387-strongdm-state-file-reuse-mguy2ohhb"},"datePublished":"2026-08-23T12:16:32.086Z","dateModified":"2026-08-23T12:18:34.448Z","description":"SpecterOps disclosed CVE-2026-4387, a vulnerability in the StrongDM desktop application where authentication material, including a JWT and public/private key...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7030359fffc5db35e25167ab04a7009c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7030359fffc5db35e25167ab04a7009c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-4387-strongdm-state-file-reuse-mguy2ohhb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,vulnerability,strongdm","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"CVE-2026-4387: StrongDM State File Reuse"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-2026-4387-strongdm-state-file-reuse-mguy2ohhb#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-4387 in StrongDM and how does the state file reuse attack work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-4387 is a StrongDM desktop vulnerability where authentication material, including a JWT and a public/private key pair, was stored in plaintext in a state.kv file at C:\\Users\\\\.sdm\\state.kv. An attacker with only user-level permissions could copy this file to another host, replace the local state.kv, and relaunch StrongDM to gain an authenticated session as the original user, including on hosts outside the original environment. Track disclosures like this StrongDM CVE alongside other vendor advisories on daily.dev."}},{"@type":"Question","name":"How was the StrongDM state file reuse vulnerability fixed and what version should I update to?","acceptedAnswer":{"@type":"Answer","text":"StrongDM fixed CVE-2026-4387 by moving credential storage to platform-native mechanisms, macOS Keychain and Windows DPAPI, instead of storing the JWT in plaintext inside state.kv. The fix shipped in Desktop version 23.74.0 and CLI version 53.77.0, implemented on March 17, 2026 for the core fix and March 24, 2026 for the CLI. Testing in May 2026 confirmed moving state files between hosts no longer grants an authenticated session. daily.dev helps teams stay on top of patch versions before an unpatched CVE gets exploited."}},{"@type":"Question","name":"What local endpoint did the StrongDM desktop application expose for authentication and how was it discovered?","acceptedAnswer":{"@type":"Answer","text":"The StrongDM desktop application exposed a local endpoint at http://127.0.0.1:65220/v2/authentication that returned the authenticated user's JWT when queried with a request containing only the Sec-Fetch-Mode: no-cors header, using curl.exe since Burp could not intercept it. A related endpoint, http://127.0.0.1:65220/v2/account, disclosed the currently authenticated account name. Researchers reverse-engineering local app endpoints can follow similar security writeups on daily.dev."}}]} ```