The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this vulnerability to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition. This poses a significant risk to the confidentiality and integrity of user data.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.5 | CVE-2025-6180 |
Exploitation
To exploit this vulnerability, an attacker would need to gain local access to the StrongDM Client environment. By intercepting the pre-authentication token, they could potentially reuse it to gain unauthorized access to user accounts, especially if they can trigger a race condition during the authentication process.
Affected Products
- StrongDM Client: The primary product affected, which fails to adequately secure pre-authentication tokens.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of the StrongDM Client, which includes security patches addressing this issue. Additionally, implementing strict access controls and monitoring for unusual authentication attempts can help reduce the risk of exploitation.