{"id":"CVE-2026-117471","kind":"vulnerability","aliases":["CVE-2026-117471"],"related":[],"title":"Psono Server: user-chosen Duo host enables internal network probing","description":"Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.","summary":"Psono Server accepted a user-supplied host when configuring a personal Duo device and connected to it without an allowlist. An authenticated user can make the server contact chosen hosts over HTTPS on port 443 and infer internal DNS names and service reachability from the responses.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["duo","internal-network","package","psono","self-hosted"],"not_affected_if":["managed-hosting","no-duo-device-config"],"how_to_check":"- Check the installed Psono Server version against the affected range 0.1.0 through 7.2.3\n- unknown for other checks","fix":"- Upgrade Psono Server CE and EE to a release later than `7.2.3`\n- unknown for a specific fixed version","status":"open","published_at":"2026-10-27T06:17:25+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","triaged_at":"2026-10-27T06:26:19+00:00","updated_at":"2026-10-27T06:26:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T06:26:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Psono Server CE and EE to a release later than `7.2.3`\n- unknown for a specific fixed version","reach":"internet","title":"Psono Server: user-chosen Duo host enables internal network probing","impact":"low","summary":"Psono Server accepted a user-supplied host when configuring a personal Duo device and connected to it without an allowlist. An authenticated user can make the server contact chosen hosts over HTTPS on port 443 and infer internal DNS names and service reachability from the responses.","category":"package","nicknames":[],"who_cares":["self-hosted","psono","duo","internal-network"],"confidence":0.7,"needs_auth":"yes","worst_case":"Server can be used to probe internal hosts for reachability.","analyst_note":"","how_to_check":"- Check the installed Psono Server version against the affected range 0.1.0 through 7.2.3\n- unknown for other checks","needs_analyst":false,"not_affected_if":["managed-hosting","no-duo-device-config"],"who_is_affected":"Teams that self-host Psono Server CE or EE in versions 0.1.0 through 7.2.3 where users can configure personal Duo devices. The exposure comes from authenticated users reaching the Duo host setting, so servers with no user accounts or without Duo device configuration are less exposed. Managed hosting by a third party is outside this issue unless the operator runs an affected version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3425,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117471':14A,17A '-2026':13A,16A '0.1.0':79C '443':62B,124C '7.2.3':81C 'accept':29B,82C 'access':154C 'allowlist':47B,103C 'also':158C 'arbitrari':150C 'attack':110C 'authent':49B,108C 'caus':112C 'ce':76C 'certif':142C 'chosen':5A,56B 'client':100C 'configur':36B,89C 'connect':42B,116C,138C 'contact':55B 'control':86C 'could':111C,157C 'cve':12A,15A 'devic':40B,93C 'distinguish':126C 'dns':66B,132C 'duo':6A,18B,39B,92C,99C 'ee':77C 'enabl':8A 'explicit':105C 'failur':127C 'flaw':146C 'host':7A,26B,34B,57B,87C,119C 'https':59B,121C 'infer':64B 'intern':9A,20B,65B,131C 'internal-network':19B 'make':52B 'mode':128C 'name':67B 'network':10A,21B 'occupi':159C 'oper':166C 'operating-system':165C 'oracl':137C 'packag':22B 'pass':95C 'person':38B,91C 'port':61B,123C,153C 'probe':11A 'protocol':151C 'provid':129C,149C 'psono':1A,23B,27B,74C 'reachabl':70B,136C 'remot':109C 'requir':140C 'respons':73B 'select':118C 'self':25B 'self-host':24B 'server':2A,28B,54B,75C,114C,161C 'servic':69B,135C 'service-reach':134C 'still':139C 'suppli':33B 'system':167C 'target':156C 'timeout':106C,168C 'tls':141C 'unrespons':155C 'user':4A,32B,50B,85C 'user-chosen':3A 'user-control':84C 'user-suppli':31B 'valid':143C 'version':78C 'without':45B,101C 'worker':162C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Psono Server CE or EE in versions 0.1.0 through 7.2.3 where users can configure personal Duo devices. The exposure comes from authenticated users reaching the Duo host setting, so servers with no user accounts or without Duo device configuration are less exposed. Managed hosting by a third party is outside this issue unless the operator runs an affected version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T06:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"fdf66990-8419-4c8c-8848-ec15d75773b4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117471","severity":null,"published_at":"2026-10-27T06:17:25+00:00","modified_at":"2026-10-27T06:17:25+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","fetched_at":"2026-10-27T06:25:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}