Psono vulnerabilities
CVEs whose affected-version data names the Psono package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-117468Medium· 6.5Device-code claim permits restricted token escalation in Psono Server
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-c…
CVE-2026-117472Medium· 4.3URL prefix handling permits API key read-scope bypass in Psono Server
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was …
CVE-2026-117470Medium· 6.5WebAuthn assertion replay permits second-factor bypass in Psono Server
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion co…
CVE-2026-117471Medium· 5.4User-controlled Duo host permits authenticated SSRF in Psono Server
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could ca…
CVE-2026-117469Medium· 5.4File-transfer type confusion permits unauthorized repository writes in Psono Server
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download trans…