Psono Server CVE-2026-117470

Requires all of: a Psono Server CE or EE instance running an affected version (3.1.0 through 7.2.3) with WebAuthn configured as the second factor; attacker possession of the victim's valid password; and capture of one valid WebAuthn assertion that can be replayed. The core flaw is that the serializer (webauthn_verify.py) verifies the assertion but never consumes/invalidates the stored challenge, so the same assertion remains valid across separate login token requests. Limiting factors that reduce real-world risk: WebAuthn 2FA must actually be in use, the password must already be compromised, and a valid assertion must be captured - this substantial precondition bundle is reflected in CVSS AC:H and the low EPSS. The flaw does not itself disclose plaintext secrets. Upgrading to 7.2.4 is the fix per the vendor.

Severity is moderate (CVSS 6.5, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) and the signals are internally consistent rather than conflicting: AC:H reflects the substantial precondition that the attacker must already possess the victim's password AND have captured one valid WebAuthn assertion. The CVSS vector records PR:N (so per the precision rules this is treated as unauthenticated), but in practice exploitation is gated behind prior credential compromise plus assertion capture, which is why complexity is High. EPSS is low (0.41%, 35th percentile) and the CVE is not on CISA KEV, so there is no evidence of widespread or active exploitation; this points to a targeted, opportunistic scenario rather than mass exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency). Net: this is a legitimately important second-factor bypass for Psono operators who rely on WebAuthn, but it is not a drop-everything emergency - the real-world bar (stolen password + captured assertion) and low EPSS keep practical risk in the moderate band. The 'Denial Of Service' tag in the input is inconsistent with A:N and CWE-294 and appears mislabeled.

An attacker who has already obtained a victim's Psono password (e.g., via phishing or a prior breach) and has captured one valid WebAuthn assertion replays that same assertion against the server during a fresh login. Because the stored challenge is not consumed after verification, the server accepts the replayed assertion with separate login tokens, bypassing the WebAuthn second factor and granting account access. No public working exploit is identified at time of analysis; the high attack complexity (AC:H) reflects the need to capture a valid assertion first.