CVE-2026-117470 Details
Description
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
A vulnerability exists in Psono Server Community and Enterprise Editions, specifically in versions 3.1.0 to 7.2.3. The issue arises because the server did not properly invalidate a stored WebAuthn challenge after verifying an assertion. This flaw allows an unauthenticated remote attacker, who has the user's password and a captured valid WebAuthn assertion, to replay the assertion with different login tokens while the original challenge remains active. As a result, the WebAuthn second factor is bypassed. The vulnerability requires interception of a valid assertion but does not expose any plaintext secrets.
Users can update to Psono Server version 7.2.4, which addresses this vulnerability by ensuring that WebAuthn challenges are properly consumed after assertion verification.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117470.md | fdf66990-8419-4c8c-8848-ec15d75773b4 | AdvisoryBroken LinkVendor |
| https://gitlab.com/esaqa/psono/psono-server | fdf66990-8419-4c8c-8848-ec15d75773b4 | Vendor |
| https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/webauthn_verify.py | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/commit/9c9a7f1701535df63370340dcc80210737dc495d | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 | fdf66990-8419-4c8c-8848-ec15d75773b4 | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | fdf66990-8419-4c8c-8848-ec15d75773b4 |
Affected Products
| Product | Versions |
|---|---|
| Psono Server CE | >= 3.1.0, <= 7.2.3 (semver) |
CPE
Remediation
| |
| Psono Server EE | >= 3.1.0, <= 7.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | fdf66990-8419-4c8c-8848-ec15d75773b4 |