---
id: "CVE-2026-117471"
kind: "vulnerability"
aliases: ["CVE-2026-117471"]
title: "Psono Server: user-chosen Duo host enables internal network probing"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["duo", "internal-network", "package", "psono", "self-hosted"]
not_affected_if: ["managed-hosting", "no-duo-device-config"]
published_at: "2026-10-27T06:17:25+00:00"
first_seen_at: "2026-10-27T06:25:21+00:00"
updated_at: "2026-10-27T06:26:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117471", "first_seen_at": "2026-10-27T06:25:21+00:00"}]
---

# Psono Server: user-chosen Duo host enables internal network probing

Psono Server accepted a user-supplied host when configuring a personal Duo device and connected to it without an allowlist. An authenticated user can make the server contact chosen hosts over HTTPS on port 443 and infer internal DNS names and service reachability from the responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Psono Server version against the affected range 0.1.0 through 7.2.3
- unknown for other checks

## Fix

- Upgrade Psono Server CE and EE to a release later than `7.2.3`
- unknown for a specific fixed version

## Timeline

- 2026-10-27T06:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117471

## From the sources

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_