Remote Code Execution Vulnerability in Psono Server by Esaqa

CVE-2026-117471

What is CVE-2026-117471?

Psono Server CE and EE versions 0.1.0 through 7.2.3 exhibit a flaw where a user-controlled host can be specified when configuring personal Duo devices. This misconfiguration allows an authenticated remote attacker to influence server connections over HTTPS on port 443. Although the server maintains TLS certificate validation, the lack of strict validation and timeout conditions can lead to potential availability issues. The vulnerability also provides an 'oracle' effect where attackers can assess service reachability and internal DNS handling, while unresponsive hosts may block server resources.

References