CVE-2026-117470: WebAuthn assertion replay permits second-factor bypass in Psono Server
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Psono Serverto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
Which deployments are affected?
Psono Server CE and EE versions 3.1.0 through 7.2.3 are affected. The issue applies to WebAuthn authentication flows that use stored challenges.
What does an attacker need to bypass the second factor?
The attacker must know the user's password and possess one captured valid WebAuthn assertion. They can then replay that assertion using separate login tokens while the stored challenge remains unchanged.
Does exploitation require an authenticated account or user interaction?
No. The attacker can be unauthenticated, and no user interaction is required, but they must first obtain both the password and a valid captured WebAuthn assertion.
What is the impact of a successful replay?
A successful replay bypasses the WebAuthn second factor for login. The issue does not itself disclose plaintext secrets.