CVE-2026-117471

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.

• CWE-918

• https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117471.md
• https://gitlab.com/esaqa/psono/psono-server
• https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/new_duo.py
• https://gitlab.com/esaqa/psono/psono-server/-/commit/4059830475744791f3d3a1daa4e1603aea5549ed
• https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4

Published

Oct 27, 2026

Last Modified

Oct 27, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11746A vulnerability has been identified in centraldogma-server v…9.4
• CVE-2026-117466In affected versions of Octopus Server, a user holding the S…8.6
• CVE-2026-117468Psono Server versions 5.3.5 through 7.2.3 used a permission …6.5
• CVE-2026-117469Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not …5.4
• CVE-2026-11747Improper neutralization of input during web page generation …6.1
• CVE-2026-117470Psono Server CE & EE versions 3.1.0 through 7.2.3 did not co…6.5
• CVE-2026-117472Psono Server CE && EE versions 4.0.33 through 7.2.3 compared…4.3
• CVE-2026-11748A vulnerability has been identified in centraldogma-server-a…6.9
• CVE-2026-117493Stored cross-site scripting (XSS) in BloX widgets. The /api/…8.3
• CVE-2026-117494Cross-Site Scripting (XSS) in the processing of SVG images s…8.3
• CVE-2026-117499@fastify/session is a session plugin for Fastify. In all rel…3.7
• CVE-2026-1175A vulnerability was identified in birkir prime up to 0.4.0.b…7.5