CVE-2026-117471
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Psono Server CE and EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle.
Risk Assessment
An attacker can map the internal network and detect available services, facilitating further attacks. Unresponsive targets may occupy server workers until the OS timeout.
Recommendation
Update Psono Server to a version later than 7.2.3. Restrict outbound HTTPS connections from the server and implement host allowlists.
Other vulnerabilities in Psono Server
See all- CVE-2026-117472Medium
Psono Server CE and EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments with URL_PREFIX, the comparison failed and the POST request was authorized with write scope instead of read scope, allowing an authenticated attacker with a read-disabled, write-enabled API key to retrieve encrypted secret data and nonces.
- CVE-2026-117470Medium
Psono Server CE and EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated attacker with the user's password and one captured valid WebAuthn assertion could replay it with separate login tokens, bypassing the WebAuthn second factor.
- CVE-2026-117469Medium
Psono Server (CE and EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated attacker with read-only access could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file.
- CVE-2026-117468Medium
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated attacker with a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days.
Original NVD description (English source)
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS