Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-117471— User-controlled Duo host permits authenticated SSRF in Psono Server

Quick assessment

Affected

esaqa GmbH Psono

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Psono Server 社区版（CE）和企业版（EE）的 0.1.0 至 7.2.3 版本在配置个人 Duo 设备时，会接受由用户控制的宿主主机地址，并在未设置白名单或明确超时的情况下将该地址传递给 Duo 客户端。已认证的远程攻击者可利用此漏洞，诱导服务器通过 HTTPS 协议在 443 端口与指定主机建立连接，并根据连接失败的具体模式进行区分，从而构建内部 DNS 查询与服务可达性预言机（oracle）。尽管连接仍要求执行 TLS 证书验证，且该漏洞无法提供任意协议或端口的访问权限，但无响应的目标主机仍可能占

CVSS 5.4 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1046 · Network Service Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

User-controlled Duo host permits authenticated SSRF in Psono Server

Source: CVE Program / CVE List V5

Vulnerability Description

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
esaqa GmbH	Psono	0.1.0 ~ 7.2.4	-

II. Public POCs for CVE-2026-117471

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117471

请登录查看更多情报信息。

Vendor Pages for CVE-2026-117471 (1)

🔗 v7.2.4 · esaqa / psono / psono-server · GitLab release-notes

Other References for CVE-2026-117471 (4)

https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/new_duo.py technical-description
https://gitlab.com/esaqa/psono/psono-server/-/commit/4059830475744791f3d3a1daa4e1603aea5549ed patch
https://gitlab.com/esaqa/psono/psono-server product
https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117471.md vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117471

Same Patch Batch · esaqa GmbH · 2026-10-27 · 5 CVEs total

CVE-2026-117468	6.5 MEDIUM	Device-code claim permits restricted token escalation in Psono Server
CVE-2026-117470	6.5 MEDIUM	WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-117469	5.4 MEDIUM	File-transfer type confusion permits unauthorized repository writes in Psono Server
CVE-2026-117472	4.3 MEDIUM	URL prefix handling permits API key read-scope bypass in Psono Server

IV. Related Vulnerabilities

Same product: Psono

Same vendor: esaqa GmbH

Same weakness: CWE-918