CVE-2025-6180 - Authentication Hijack

Back Back to CVE browser

HIGH

Authentication Hijack

Published Aug 20, 2025

8.5

HIGH

CVSS 4.0

EPSS 0.11%

Description

The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.

Affected products

Vendor StrongDM Product Sdm-Cli Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=47.96.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

StrongDM

Sdm-Cli

unaffected

Version	Status	Constraints
0	affected	<=47.96.0

Remediation

Vendor solution

Any customers using sdm-cli below version 47.97.0 should update to or beyond version 47.97.0.

Weaknesses (1)

CWE-319

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25352		Advisory
https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner StrongDM

Published Aug 20, 2025

Updated Aug 20, 2025

Reserved Jun 16, 2025

Link CVE-2025-6180

CISA Vulnrichment

Updated Aug 20, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-6180

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-6180

ENISA EUVD

Assigner StrongDM

Published Aug 20, 2025

Updated Aug 20, 2025

Exploited since n/a

Link EUVD-2025-25352

EUVD-2025-25352