CVE-2026-117471: User-controlled Duo host permits authenticated SSRF in Psono Server
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Psono Serverto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Psono Server and able to configure a personal Duo device. The affected behavior is present in both Community Edition and Enterprise Edition releases from 0.1.0 through 7.2.3.
What network access does exploitation provide?
The server can be induced to make HTTPS connections to attacker-selected hosts on port 443. TLS certificate validation remains required, so this does not provide unrestricted access to arbitrary internal services, protocols, or ports.
What could an attacker learn or disrupt?
By distinguishing connection failure modes, an attacker can use the server as an oracle for internal DNS resolution and HTTPS service reachability. Targets that do not respond may also hold a server worker until the operating-system connection timeout expires.