{"id":"CVE-2026-117470","kind":"vulnerability","aliases":["CVE-2026-117470"],"related":[],"title":"Psono Server: WebAuthn challenge reuse lets a captured login bypass second factor","description":"Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.","summary":"Psono Server versions 3.1.0 through 7.2.3 did not discard a stored WebAuthn challenge after it was verified. An attacker who knows a user's password and has captured one valid WebAuthn assertion can replay that assertion to log in without the second factor.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","password-manager","psono","self-hosted","webauthn"],"not_affected_if":["managed-hosting","versions-outside-3.1.0-to-7.2.3","webauthn-not-enabled"],"how_to_check":"- Check the installed Psono Server version against the affected range 3.1.0 through 7.2.3\n- Review the Psono Server release notes or changelog for a fix that consumes the WebAuthn challenge after assertion verification\n- unknown whether the sources list a specific config or endpoint to inspect","fix":"- Upgrade Psono Server CE and EE to a release later than `7.2.3` (exact fixed version: unknown in the sources)\n- Until patched, require users to rely on other second factors and rotate passwords for accounts with WebAuthn enabled","status":"open","published_at":"2026-10-27T06:17:24+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","triaged_at":"2026-10-27T06:26:20+00:00","updated_at":"2026-10-27T06:26:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T06:26:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Psono Server CE and EE to a release later than `7.2.3` (exact fixed version: unknown in the sources)\n- Until patched, require users to rely on other second factors and rotate passwords for accounts with WebAuthn enabled","reach":"internet","title":"Psono Server: WebAuthn challenge reuse lets a captured login bypass second factor","impact":"medium","summary":"Psono Server versions 3.1.0 through 7.2.3 did not discard a stored WebAuthn challenge after it was verified. An attacker who knows a user's password and has captured one valid WebAuthn assertion can replay that assertion to log in without the second factor.","category":"package","nicknames":[],"who_cares":["psono","self-hosted","webauthn","password-manager"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker logs in as a user by replaying a captured WebAuthn assertion","analyst_note":"Confirm the fixed version and whether the NVD entry or Psono advisory names a patched release; sources list no fix version.","how_to_check":"- Check the installed Psono Server version against the affected range 3.1.0 through 7.2.3\n- Review the Psono Server release notes or changelog for a fix that consumes the WebAuthn challenge after assertion verification\n- unknown whether the sources list a specific config or endpoint to inspect","needs_analyst":true,"not_affected_if":["managed-hosting","versions-outside-3.1.0-to-7.2.3","webauthn-not-enabled"],"who_is_affected":"Self-hosted Psono Server deployments running versions 3.1.0 through 7.2.3 that use WebAuthn as a second factor are exposed. The attack needs the user's password and one captured valid assertion, so it is mainly a risk where an attacker can also observe login traffic. Teams on managed hosting or on versions outside the range can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3385,"output_tokens":692,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117470':15A,18A '-2026':14A,17A '3.1.0':31B,76C '7.2.3':33B,78C 'assert':59B,63B,87C,104C,108C,131C 'attack':46B,92C,125C 'bypass':10A,119C 'captur':8A,55B,101C,127C 'ce':73C 'challeng':4A,40B,85C,116C 'consum':81C 'could':105C 'cve':13A,16A 'discard':36B 'disclos':136C 'ee':74C 'factor':12A,70B,123C 'host':26B 'know':48B 'let':6A 'log':65B 'login':9A,111C 'manag':22B 'one':56B,100C 'packag':19B 'password':21B,52B,98C 'password-manag':20B 'plaintext':137C 'possess':94C 'psono':1A,23B,28B,71C 'remain':117C 'remot':91C 'replay':61B,106C 'requir':126C 'reus':5A 'second':11A,69B,122C 'secret':138C 'self':25B 'self-host':24B 'separ':110C 'server':2A,29B,72C 'store':38B,83C,115C 'token':112C 'unauthent':90C 'unchang':118C 'user':50B,96C 'valid':57B,102C,130C 'verif':88C 'verifi':44B 'version':30B,75C 'webauthn':3A,27B,39B,58B,84C,103C,121C 'without':67B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Psono Server deployments running versions 3.1.0 through 7.2.3 that use WebAuthn as a second factor are exposed. The attack needs the user's password and one captured valid assertion, so it is mainly a risk where an attacker can also observe login traffic. Teams on managed hosting or on versions outside the range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T06:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","cvss_by":"fdf66990-8419-4c8c-8848-ec15d75773b4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117470","severity":null,"published_at":"2026-10-27T06:17:24+00:00","modified_at":"2026-10-27T06:17:24+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","fetched_at":"2026-10-27T06:25:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}