Authentication Bypass in Psono Server by Psono

CVE-2026-117472

What is CVE-2026-117472?

The Psono Server versions 4.0.33 through 7.2.3 are vulnerable due to a flaw in the handling of request paths for the bulk-secret-read endpoint. This vulnerability arises when deployments are configured with a URL_PREFIX, leading to an authorization failure. As a result, an authenticated remote attacker possessing a read-disabled and write-enabled API key can exploit this issue to access encrypted secret data and nonces, circumventing the intended read permissions. The vulnerability does not affect the default configuration without URL_PREFIX.

References