6.5
MediumCVSS 3.1 · from esaqa
CVE-2026-117470
WebAuthn assertion replay permits second-factor bypass in Psono Server
Psono · CWE-294 · CWE-294AffectedPsono
FixUpdate to 7.2.4 or newer
PublishedOct 27, 05:53 · esaqa
ScoredOct 27 · 6.5 · esaqa
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can change data. CVSS impact.
Description
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
From esaqa
Affected and fixed versions
ProductAffectedFixed inPsono3.1.0 – before 7.2.47.2.4
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known