CVE-2026-117471

Psono Server CE and EE versions 0.1.0 through 7.2.3 are vulnerable to Server-Side Request Forgery (SSRF) . The application accepts a user-controlled host during personal Duo device configuration and passes it to the Duo client without an allowlist or explicit timeout. This allows an authenticated...

CVE-2026-117471 User-controlled Duo host permits authenticated SSRF in Psono Server

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on po...