CVE-2026-117471Published

User-controlled Duo host permits authenticated SSRF in Psono Server

Exact source revision recorded 27 Oct 2026 07:22:55 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-117471

Published

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.

Source published: 27 Oct 2026 05:55:07 UTC
Source modified: 27 Oct 2026 05:55:07 UTC
Observed here: 27 Oct 2026 07:22:55 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L