CVE-2026-117470— WebAuthn assertion replay permits second-factor bypass in Psono Server

Quick assessment

Affected

esaqa GmbH Psono

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Psono Server 社区版（CE）和企业版（EE）3.1.0 至 7.2.3 版本在验证 WebAuthn 断言后，未消耗已存储的 WebAuthn 挑战（challenge）。若攻击者已获取用户密码并捕获了一条有效的 WebAuthn 断言，则可在未认证的情况下远程重放该断言，配合不同的登录令牌进行多次尝试；由于存储的挑战值保持不变，攻击者得以绕过 WebAuthn 第二因素认证。该攻击需要预先捕获一条有效的断言，但攻击过程本身不会泄露明文密钥。

CVSS 6.5 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1110.001 · Password Guessing T1550.004 · Web Session Cookie

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WebAuthn assertion replay permits second-factor bypass in Psono Server

Source: CVE Program / CVE List V5

Vulnerability Description

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用捕获-重放进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
esaqa GmbH	Psono	3.1.0 ~ 7.2.4	-

II. Public POCs for CVE-2026-117470

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117470

请登录查看更多情报信息。

Other References for CVE-2026-117470 (5)

https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/webauthn_verify.py technical-description
https://gitlab.com/esaqa/psono/psono-server/-/commit/9c9a7f1701535df63370340dcc80210737dc495d patch
https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 release-notes
https://gitlab.com/esaqa/psono/psono-server product
https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117470.md vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117470

Same Patch Batch · esaqa GmbH · 2026-10-27 · 5 CVEs total

CVE-2026-117468	6.5 MEDIUM	Device-code claim permits restricted token escalation in Psono Server
CVE-2026-117471	5.4 MEDIUM	User-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2026-117469	5.4 MEDIUM	File-transfer type confusion permits unauthorized repository writes in Psono Server
CVE-2026-117472	4.3 MEDIUM	URL prefix handling permits API key read-scope bypass in Psono Server

IV. Related Vulnerabilities

Same product: Psono

Same vendor: esaqa GmbH

Same weakness: CWE-294