WebAuthn Bypass Vulnerability in Psono Server Products by Psono

CVE-2026-117470

What is CVE-2026-117470?

Certain versions of Psono Server, both Community Edition (CE) and Enterprise Edition (EE), contain a vulnerability that allows an unauthenticated remote attacker to bypass the WebAuthn second factor of authentication. This is achieved by exploiting the failure to consume a stored WebAuthn challenge after the verification process. If an attacker captures a valid WebAuthn assertion along with the user's password, they can replay the assertion with different login tokens, while the originally stored challenge remains unaltered. This vulnerability highlights the importance of robust verification mechanisms in multi-factor authentication systems.

References