Search
Find a vulnerability
Search criteria
10 vulnerabilities found for Psono by esaqa GmbH
CVE-2026-117472 (GCVE-0-2026-117472)
Vulnerability from nvd – Published: 2026-10-27 05:56 – Updated: 2026-10-27 05:56
VLAI
EPSS
VEX
Title
URL prefix handling permits API key read-scope bypass in Psono Server
Summary
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
4.0.33 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/permissions.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "4.0.33",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server CE \u0026amp;\u0026amp; EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.\u003c/p\u003e"
}
],
"value": "Psono Server CE \u0026\u0026 EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A write-only API key could read encrypted secret records through the bulk-secret-read endpoint despite having its read scope disabled."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:56:16.775Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117472",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T08:29:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono CE \u0026 EE Server 7.2.4 released"
}
],
"title": "URL prefix handling permits API key read-scope bypass in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117472",
"datePublished": "2026-10-27T05:56:16.775Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:56:16.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117471 (GCVE-0-2026-117471)
Vulnerability from nvd – Published: 2026-10-27 05:55 – Updated: 2026-10-27 05:55
VLAI
EPSS
VEX
Title
User-controlled Duo host permits authenticated SSRF in Psono Server
Summary
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
Severity
5.4 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
0.1.0 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/serializers/new_duo.py",
"psono/restapi/utils/duo.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server CE \u0026amp;\u0026amp; EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.\u003c/p\u003e"
}
],
"value": "Psono Server CE \u0026\u0026 EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An authenticated user could induce outbound HTTPS connections to selected hosts, use response differences as an internal reachability oracle, and occupy workers through connection timeouts."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:55:07.068Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117471",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117471.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/new_duo.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/4059830475744791f3d3a1daa4e1603aea5549ed"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T08:07:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono Server CE \u0026 EE 7.2.4 released"
}
],
"title": "User-controlled Duo host permits authenticated SSRF in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117471",
"datePublished": "2026-10-27T05:55:07.068Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:55:07.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117470 (GCVE-0-2026-117470)
Vulnerability from nvd – Published: 2026-10-27 05:53 – Updated: 2026-10-27 05:53
VLAI
EPSS
VEX
Title
WebAuthn assertion replay permits second-factor bypass in Psono Server
Summary
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
Severity
6.5 (Medium)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
3.1.0 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/serializers/webauthn_verify.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server CE \u0026amp; EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user\u0027s password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.\u003c/p\u003e"
}
],
"value": "Psono Server CE \u0026 EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user\u0027s password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker with a user\u0027s password and one captured valid WebAuthn assertion could replay the assertion to bypass the WebAuthn second factor and gain account access."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:53:41.709Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117470",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117470.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/webauthn_verify.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/9c9a7f1701535df63370340dcc80210737dc495d"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T07:49:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono Server CE \u0026 EE 7.2.4 released"
}
],
"title": "WebAuthn assertion replay permits second-factor bypass in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117470",
"datePublished": "2026-10-27T05:53:41.709Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:53:41.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117469 (GCVE-0-2026-117469)
Vulnerability from nvd – Published: 2026-10-27 05:52 – Updated: 2026-10-27 05:52
VLAI
EPSS
VEX
Title
File-transfer type confusion permits unauthorized repository writes in Psono Server
Summary
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
Severity
5.4 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
1.0.0 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/serializers/file_repository_upload.py",
"psono/restapi/serializers/file_repository_download.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server (CE \u0026amp; EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner\u0027s file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.\u003c/p\u003e"
}
],
"value": "Psono Server (CE \u0026 EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner\u0027s file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A user with read-only file access could upload objects and append chunks in the file owner\u0027s external repository, affecting storage integrity and availability."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:52:24.709Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117469",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117469.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/file_repository_upload.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/64753b19bd8d03cfbed20db575f4dccb220d9ca4"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T07:32:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono Server CE \u0026 EE 7.2.4 released"
}
],
"title": "File-transfer type confusion permits unauthorized repository writes in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117469",
"datePublished": "2026-10-27T05:52:24.709Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:52:24.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117468 (GCVE-0-2026-117468)
Vulnerability from nvd – Published: 2026-10-27 05:41 – Updated: 2026-10-27 05:59
VLAI
EPSS
VEX
Title
Device-code claim permits restricted token escalation in Psono Server
Summary
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Severity
6.5 (Medium)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
5.3.5 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/views/device_code_claim.py",
"psono/restapi/views/device_code_token.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "5.3.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token\u0027s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.\u003c/p\u003e"
}
],
"value": "Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token\u0027s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A restricted, short-lived API key session could be escalated to a full read-write session lasting up to 365 days, enabling unauthorized modification of encrypted secrets and shares."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:59:08.920Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/views/device_code_claim.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/19ed5a192c704fece1645d946b6f4c36045bacbe"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117468.md"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T07:13:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono CE \u0026 EE Server 7.2.4 released"
}
],
"title": "Device-code claim permits restricted token escalation in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117468",
"datePublished": "2026-10-27T05:41:30.742Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:59:08.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117472 (GCVE-0-2026-117472)
Vulnerability from cvelistv5 – Published: 2026-10-27 05:56 – Updated: 2026-10-27 05:56
VLAI
EPSS
VEX
Title
URL prefix handling permits API key read-scope bypass in Psono Server
Summary
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
4.0.33 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/permissions.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "4.0.33",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server CE \u0026amp;\u0026amp; EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.\u003c/p\u003e"
}
],
"value": "Psono Server CE \u0026\u0026 EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A write-only API key could read encrypted secret records through the bulk-secret-read endpoint despite having its read scope disabled."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:56:16.775Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117472",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T08:29:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono CE \u0026 EE Server 7.2.4 released"
}
],
"title": "URL prefix handling permits API key read-scope bypass in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117472",
"datePublished": "2026-10-27T05:56:16.775Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:56:16.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117471 (GCVE-0-2026-117471)
Vulnerability from cvelistv5 – Published: 2026-10-27 05:55 – Updated: 2026-10-27 05:55
VLAI
EPSS
VEX
Title
User-controlled Duo host permits authenticated SSRF in Psono Server
Summary
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
Severity
5.4 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
0.1.0 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/serializers/new_duo.py",
"psono/restapi/utils/duo.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server CE \u0026amp;\u0026amp; EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.\u003c/p\u003e"
}
],
"value": "Psono Server CE \u0026\u0026 EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An authenticated user could induce outbound HTTPS connections to selected hosts, use response differences as an internal reachability oracle, and occupy workers through connection timeouts."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:55:07.068Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117471",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117471.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/new_duo.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/4059830475744791f3d3a1daa4e1603aea5549ed"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T08:07:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono Server CE \u0026 EE 7.2.4 released"
}
],
"title": "User-controlled Duo host permits authenticated SSRF in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117471",
"datePublished": "2026-10-27T05:55:07.068Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:55:07.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117470 (GCVE-0-2026-117470)
Vulnerability from cvelistv5 – Published: 2026-10-27 05:53 – Updated: 2026-10-27 05:53
VLAI
EPSS
VEX
Title
WebAuthn assertion replay permits second-factor bypass in Psono Server
Summary
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
Severity
6.5 (Medium)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
3.1.0 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/serializers/webauthn_verify.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server CE \u0026amp; EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user\u0027s password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.\u003c/p\u003e"
}
],
"value": "Psono Server CE \u0026 EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user\u0027s password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker with a user\u0027s password and one captured valid WebAuthn assertion could replay the assertion to bypass the WebAuthn second factor and gain account access."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:53:41.709Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117470",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117470.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/webauthn_verify.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/9c9a7f1701535df63370340dcc80210737dc495d"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T07:49:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono Server CE \u0026 EE 7.2.4 released"
}
],
"title": "WebAuthn assertion replay permits second-factor bypass in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117470",
"datePublished": "2026-10-27T05:53:41.709Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:53:41.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117469 (GCVE-0-2026-117469)
Vulnerability from cvelistv5 – Published: 2026-10-27 05:52 – Updated: 2026-10-27 05:52
VLAI
EPSS
VEX
Title
File-transfer type confusion permits unauthorized repository writes in Psono Server
Summary
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
Severity
5.4 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
1.0.0 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/serializers/file_repository_upload.py",
"psono/restapi/serializers/file_repository_download.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server (CE \u0026amp; EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner\u0027s file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.\u003c/p\u003e"
}
],
"value": "Psono Server (CE \u0026 EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner\u0027s file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A user with read-only file access could upload objects and append chunks in the file owner\u0027s external repository, affecting storage integrity and availability."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:52:24.709Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"name": "Vendor security advisory for CVE-2026-117469",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117469.md"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/file_repository_upload.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/64753b19bd8d03cfbed20db575f4dccb220d9ca4"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T07:32:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono Server CE \u0026 EE 7.2.4 released"
}
],
"title": "File-transfer type confusion permits unauthorized repository writes in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117469",
"datePublished": "2026-10-27T05:52:24.709Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:52:24.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117468 (GCVE-0-2026-117468)
Vulnerability from cvelistv5 – Published: 2026-10-27 05:41 – Updated: 2026-10-27 05:59
VLAI
EPSS
VEX
Title
Device-code claim permits restricted token escalation in Psono Server
Summary
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Severity
6.5 (Medium)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.com/esaqa/psono/psono-server/-/blo… | technical-description |
| https://gitlab.com/esaqa/psono/psono-server/-/com… | patch |
| https://gitlab.com/esaqa/psono/psono-server/-/rel… | release-notes |
| https://gitlab.com/esaqa/psono/psono-server | product |
| https://gitlab.com/esaqa/esaqa/security-advisorie… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| esaqa GmbH | Psono |
Affected:
5.3.5 , < 7.2.4
(semver)
|
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Psono Server Community Edition",
"Psono Server Enterprise Edition"
],
"product": "Psono",
"programFiles": [
"psono/restapi/views/device_code_claim.py",
"psono/restapi/views/device_code_token.py"
],
"repo": "https://gitlab.com/esaqa/psono/psono-server",
"vendor": "esaqa GmbH",
"versions": [
{
"lessThan": "7.2.4",
"status": "affected",
"version": "5.3.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Chaplin"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePsono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token\u0027s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.\u003c/p\u003e"
}
],
"value": "Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token\u0027s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A restricted, short-lived API key session could be escalated to a full read-write session lasting up to 365 days, enabling unauthorized modification of encrypted secrets and shares."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T05:59:08.920Z",
"orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"shortName": "esaqa"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/views/device_code_claim.py"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/19ed5a192c704fece1645d946b6f4c36045bacbe"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/esaqa/psono/psono-server"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117468.md"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Psono Server 7.2.4 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-29T16:10:00.000Z",
"value": "Vulnerability reported to vendor"
},
{
"lang": "en",
"time": "2026-07-30T07:13:00.000Z",
"value": "Vendor fix implemented"
},
{
"lang": "en",
"time": "2026-07-30T13:16:00.000Z",
"value": "Psono CE \u0026 EE Server 7.2.4 released"
}
],
"title": "Device-code claim permits restricted token escalation in Psono Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
"assignerShortName": "esaqa",
"cveId": "CVE-2026-117468",
"datePublished": "2026-10-27T05:41:30.742Z",
"dateReserved": "2026-10-27T05:33:18.001Z",
"dateUpdated": "2026-10-27T05:59:08.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}