TI-2025-05589 Aliases CVE-2025-6180 GHSA-54jv-mpgv-wvp2

Authentication Hijack

LOW 36CWE-319Published 2025-08-20 · Updated 2025-08-20

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00111 1st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
StrongDM	sdm-cli	up to 47.96.0	—	No fix listed	CNA

sdm-cli VendorStrongDM Affected up to 47.96.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-6180
2026-10-03 Alias added: GHSA-54jv-mpgv-wvp2

References

Other 1

https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed

TI-2025-05590 OS command injection in StrongDM sdm-cli CVSS 4.0HIGH 8.5
TI-2025-05591 Root Certificate Injection CVSS 4.0HIGH 8.5
TI-2025-05592 Configd Injection CVSS 4.0HIGH 7.0
TI-2026-03815 Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file CVSS 4.0LOW 2.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences