---
id: "CVE-2026-117470"
kind: "vulnerability"
aliases: ["CVE-2026-117470"]
title: "Psono Server: WebAuthn challenge reuse lets a captured login bypass second factor"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "password-manager", "psono", "self-hosted", "webauthn"]
not_affected_if: ["managed-hosting", "versions-outside-3.1.0-to-7.2.3", "webauthn-not-enabled"]
published_at: "2026-10-27T06:17:24+00:00"
first_seen_at: "2026-10-27T06:25:21+00:00"
updated_at: "2026-10-27T06:26:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117470", "first_seen_at": "2026-10-27T06:25:21+00:00"}]
---

# Psono Server: WebAuthn challenge reuse lets a captured login bypass second factor

Psono Server versions 3.1.0 through 7.2.3 did not discard a stored WebAuthn challenge after it was verified. An attacker who knows a user's password and has captured one valid WebAuthn assertion can replay that assertion to log in without the second factor.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Psono Server version against the affected range 3.1.0 through 7.2.3
- Review the Psono Server release notes or changelog for a fix that consumes the WebAuthn challenge after assertion verification
- unknown whether the sources list a specific config or endpoint to inspect

## Fix

- Upgrade Psono Server CE and EE to a release later than `7.2.3` (exact fixed version: unknown in the sources)
- Until patched, require users to rely on other second factors and rotate passwords for accounts with WebAuthn enabled

## Timeline

- 2026-10-27T06:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117470

## From the sources

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_