Live › vulnerability › CVE-2026-117470
Go to dashboardPsono Server versions 3.1.0 through 7.2.3 did not discard a stored WebAuthn challenge after it was verified. An attacker who knows a user's password and has captured one valid WebAuthn assertion can replay that assertion to log in without the second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 06:25 UTC. All times on this page are UTC.
Self-hosted Psono Server deployments running versions 3.1.0 through 7.2.3 that use WebAuthn as a second factor are exposed. The attack needs the user's password and one captured valid assertion, so it is mainly a risk where an attacker can also observe login traffic. Teams on managed hosting or on versions outside the range can skip it.
No product ranges from the sources yet.
7.2.3 (exact fixed version: unknown in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-117470")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.