CVE-2026-117471 in Psono
Summary
by MITRE • 10/27/2026
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Psono Server Community Edition and Enterprise Edition versions 0.1.0 through 7.2.3 represents a significant security misconfiguration related to how user-supplied input is handled during the setup of personal Duo authentication devices. The core technical flaw lies in the server's acceptance of an arbitrary, user-controlled host parameter when configuring these devices. Instead of validating this input against a strict allowlist or enforcing explicit timeout constraints, the application directly passes the provided hostname to the underlying Duo client library for processing. This design oversight allows an authenticated remote attacker to dictate which external hosts the Psono Server attempts to connect to over HTTPS on port 443 during the authentication flow validation process.
From an operational perspective, this flaw transforms the vulnerable server into a powerful internal oracle capable of performing network reconnaissance and service reachability testing within the organization's infrastructure. Because the application distinguishes between different failure modes based on the response from the target host, attackers can infer information about the existence and status of internal services that would otherwise be inaccessible to them directly. This capability effectively bypasses standard perimeter defenses by leveraging the server as a pivot point for network scanning. The attacker does not need arbitrary protocol or port access; the restriction to HTTPS on port 443 is sufficient to probe for specific web-based services, such as administrative interfaces, internal APIs, or other HTTP-dependent applications running within the trusted network zone.
The exploitation of this vulnerability relies heavily on TLS certificate validation mechanisms remaining intact. Since connections still require valid TLS certificates from the target host, attackers are primarily limited to probing hosts that present legitimate, publicly trusted, or organizationally signed certificates. This constraint means that while the attacker can confirm the presence and reachability of services with proper SSL/TLS configurations, they cannot easily probe internal services using self-signed certificates unless those certificates are explicitly trusted by the Psono server's certificate store. However, even within these limitations, the ability to map out which internal hosts respond positively versus negatively provides a detailed picture of the network topology and service deployment strategies employed by the organization.
A secondary impact vector involves resource exhaustion through denial-of-service conditions. If an attacker directs connections toward unresponsive or slow-responding targets, each connection attempt occupies a server worker thread until the operating system's TCP timeout is reached. In environments with limited concurrency resources, this behavior can be leveraged to degrade service availability for legitimate users by tying up worker threads in prolonged wait states. This aspect of the vulnerability highlights how improper input handling not only leads to information disclosure but also impacts the stability and performance of the authentication infrastructure itself.
To mitigate these risks, organizations running affected versions of Psono Server must immediately upgrade to a patched version where this issue has been resolved. The remediation strategy should involve implementing strict allowlisting for any host parameters accepted during device configuration processes, ensuring that only pre-approved domains or IP ranges can be utilized. Additionally, enforcing explicit timeout configurations on all outbound network connections initiated by the application is critical to preventing resource exhaustion attacks and limiting the window of opportunity for oracle-based reconnaissance. Security teams should also review their internal TLS certificate policies and consider restricting trust stores if possible, although upgrading remains the primary defense against this specific implementation flaw. This vulnerability aligns with CWE-20 Improper Input Validation and can be categorized under ATT&CK techniques related to Network Service Discovery and Internal Reconnaissance via compromised infrastructure.