CVE-2025-6180 Details
Description
The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.
A vulnerability has been identified in the StrongDM Client that inadequately protected a pre-authentication token. This flaw allows attackers to intercept and reuse the token, potentially exploiting it to redeem valid authentication credentials through a race condition. The vulnerability affects all client application CLI versions prior to 47.97.0.
Users are advised to update to version 47.97.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 20, 2025CISA-ADP
Assessed Aug 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed | StrongDM | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | StrongDM |
Affected Products
| Product | Versions |
|---|---|
| StrongDM Client | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | StrongDM |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 20, 2025 | New CVE Received | StrongDM |