StrongDM Desktop Application on Microsoft Windows prior to version 23.74.0 stores authentication state data, such as JSON Web Tokens and asymmetric key material, in cleartext within a per-user state file located at C:\Users\<username>\.sdm\state.kv. This file is protected only by default NTFS permissions, meaning any local user with read access to the profile directory could potentially access sensitive authentication information. Exploitation requires local access and additional deployment conditions. The vulnerability is categorized under CWE-312 (Cleartext Storage of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials). No official patch or remediation level has been published yet by StrongDM.

If an attacker gains local read access to the affected user's profile directory, they could obtain sensitive authentication tokens and key material stored in cleartext. This could potentially allow unauthorized access to StrongDM resources under the affected user's credentials. However, exploitation requires local access and additional conditions, limiting the overall risk. The CVSS score of 2.0 indicates low severity and limited impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to user profile directories and ensure NTFS permissions are properly configured to limit unauthorized read access. Monitor vendor communications for updates on patches or official mitigations.