Live › vulnerability › CVE-2026-117471
Go to dashboardPsono Server accepted a user-supplied host when configuring a personal Duo device and connected to it without an allowlist. An authenticated user can make the server contact chosen hosts over HTTPS on port 443 and infer internal DNS names and service reachability from the responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 06:25 UTC. All times on this page are UTC.
Teams that self-host Psono Server CE or EE in versions 0.1.0 through 7.2.3 where users can configure personal Duo devices. The exposure comes from authenticated users reaching the Duo host setting, so servers with no user accounts or without Duo device configuration are less exposed. Managed hosting by a third party is outside this issue unless the operator runs an affected version.
No product ranges from the sources yet.
7.2.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
This page as .md · .json · in your agent: get_signal("CVE-2026-117471")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.