# CVE-2026-117471: Psono Server SSRF via user-controlled Duo host parameter

Source: https://junglewise.ai/threats/cve-2026-117471-psono-server-ce-ee-versions-0-1-0-through-7-2-3-accepted-a-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117471 · Severity: medium · CVSS 5.4 · Published 2026-10-27

Psono Server is a password management system. Versions 0.1.0 through 7.2.3 allow an authenticated attacker to manipulate Duo device configuration and force the server to connect to arbitrary hosts, enabling network reconnaissance of internal systems and potential denial-of-service through connection exhaustion.

Technologies: [Psono Server Community Edition](https://junglewise.ai/threats/technologies/server-community-edition), [Psono Server Enterprise Edition](https://junglewise.ai/threats/technologies/server-enterprise-edition). Vendors: [Psono](https://junglewise.ai/threats/vendors/psono).

## Quick answers

**Is CVE-2026-117471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117471 being exploited in the wild.

**How severe is CVE-2026-117471?** Medium severity, with a CVSS score of 5.4, published 27 October 2026.

**Which products and versions are affected?** Psono Server Community Edition 0.1.0 through 7.2.3; Psono Server Enterprise Edition 0.1.0 through 7.2.3.

**Is there a fix for CVE-2026-117471?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-117471 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-117471?** Check whether you run Psono Server Community Edition or Psono Server Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability in Psono Server's Duo authentication configuration accepts user-controlled hostnames without validation or an allowlist, passing them directly to the Duo client library. An authenticated remote attacker can probe internal network reachability and DNS resolution by observing connection failure modes on HTTPS port 443. While TLS certificate validation prevents arbitrary HTTPS traffic, unresponsive targets can exhaust server worker threads through OS-level timeouts.

## Affected products

- Psono Server Community Edition 0.1.0 through 7.2.3
- Psono Server Enterprise Edition 0.1.0 through 7.2.3

## Timeline

- 2026-10-27: disclosed

## References

- [https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117471.md](https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117471.md)
- [https://gitlab.com/esaqa/psono/psono-server](https://gitlab.com/esaqa/psono/psono-server)

## Related threats

- [Psono Server WebAuthn assertion replay in authentication](https://junglewise.ai/threats/cve-2026-117470-psono-server-ce-ee-versions-3-1-0-through-7-2-3-did-not-consume)
- [Psono Server file-transfer credential direction enforcement flaw](https://junglewise.ai/threats/cve-2026-117469-psono-server-ce-ee-versions-1-0-0-through-7-2-3-did-not-enforce)