CVE-2026-117471 Details
Description
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
A server-side request forgery (SSRF) vulnerability has been identified in Psono Server Community Edition and Enterprise Edition, affecting versions 0.1.0 through 7.2.3. The vulnerability arises from the server accepting a user-controlled host when configuring a personal Duo device, which is then passed to the Duo client without an allowlist or explicit timeout. This flaw allows an authenticated remote attacker to induce outbound HTTPS connections to selected hosts over port 443, creating an internal DNS and service-reachability oracle. While the vulnerability does not provide arbitrary protocol or port access, unresponsive targets could occupy a server worker until the operating system timeout.
Users can upgrade to Psono Server Community Edition or Enterprise Edition version 7.2.4 or later. If an immediate upgrade is not possible, users should prevent the configuration of personal Duo hosts and restrict server egress on port 443 to approved Duo domains.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117471.md | fdf66990-8419-4c8c-8848-ec15d75773b4 | AdvisoryRemedyVendor |
| https://gitlab.com/esaqa/psono/psono-server | fdf66990-8419-4c8c-8848-ec15d75773b4 | Vendor |
| https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/new_duo.py | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/commit/4059830475744791f3d3a1daa4e1603aea5549ed | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 | fdf66990-8419-4c8c-8848-ec15d75773b4 | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | fdf66990-8419-4c8c-8848-ec15d75773b4 |
Affected Products
| Product | Versions |
|---|---|
| Psono Server | >= 0.1.0, <= 7.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | fdf66990-8419-4c8c-8848-ec15d75773b4 |