Psono Server EUVD-2026-110605

Requires an authenticated remote user (PR:L) who can reach the personal Duo device configuration feature and supply a user-controlled host, which is then passed to the Duo client without a host allowlist or explicit timeout. Exploitation is materially limited: the server still performs TLS certificate validation, connections are restricted to HTTPS on port 443, and the flaw does not permit arbitrary protocol or port access - so the capability is confined to a reachability/DNS oracle (and worker exhaustion against unresponsive targets until the OS timeout), not arbitrary internal data retrieval. The practical prerequisite is that Duo MFA enrollment is available to the attacker's account.

This is a moderate, authenticated-only SSRF (CWE-918) in the Psono self-hosted password manager, and the signals align consistently toward a 'patch on a normal cycle' posture rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L, base 5.4) indicates a network-reachable but authenticated (PR:L) attacker with low complexity, yielding only low confidentiality impact (the information-disclosure oracle) and low availability impact (worker occupied until OS timeout); there is no integrity impact and no scope change. The EPSS score is low (0.24%, 15th percentile), there is no CISA KEV listing, and no public exploit is identified in the input - all three exploitation signals agree the real-world exploitation pressure is low. The vuln.today decision label is 'this_month', consistent with a genuine but non-urgent fix. Importantly, the description itself constrains impact: TLS certificate validation is still enforced and the flaw does NOT grant arbitrary protocol or port access, so this is a restricted HTTPS/443 reachability-and-DNS oracle, not a full-read SSRF into cloud metadata or arbitrary internal services. The net picture is a real but bounded issue: a valid, authenticated user could map internal network reachability, which matters most in environments where Psono users are not fully trusted or where internal topology is sensitive. No key signals conflict; the main caveat is that POC status is simply absent rather than confirmed negative.

An authenticated Psono user navigates to configure a personal Duo MFA device and supplies an attacker-chosen hostname instead of a legitimate Duo endpoint. The Psono server then connects to that host over HTTPS/443, and by distinguishing the resulting failure modes the attacker infers whether the target resolves in internal DNS and whether the service is reachable, effectively using the server as an internal reachability and DNS oracle. No public exploit is identified at time of analysis; because the CVSS vector is PR:L, this requires a valid authenticated account and low attack complexity.