CVE-2026-117470Medium· 6.5▾ SunlitPsono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion co…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
Psono >= 3.1.0 < 7.2.4Upgrade to Psono Server 7.2.4 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117468Medium· 6.5Device-code claim permits restricted token escalation in Psono Server
CVE-2026-117472Medium· 4.3URL prefix handling permits API key read-scope bypass in Psono Server
CVE-2026-117471Medium· 5.4User-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2026-117469Medium· 5.4File-transfer type confusion permits unauthorized repository writes in Psono Server
CVE-2026-104381Medium· 6.0Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service
CVE-2026-41020High· 7.5Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.