Vulnerabilities

TI-2026-81021 CVE-2026-117472 · GHSA-4hh2-mhpm-69h3

URL prefix handling permits API key read-scope bypass in Psono Server

LOW 20

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00323 Published 2026-10-27 Fixed in 7.2.4 CWE-863

TI-2026-81018 CVE-2026-117471 · GHSA-q3ph-3gv2-g5wq

User-controlled Duo host enables SSRF in Psono Server

LOW 24

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00242 Published 2026-10-27 Fixed in 7.2.4 CWE-918

TI-2026-81017 CVE-2026-117470 · GHSA-3gq2-hx4p-69qc

WebAuthn assertion replay permits second-factor bypass in Psono Server

LOW 29

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00408 Published 2026-10-27 Fixed in 7.2.4 CWE-294

TI-2026-81016 CVE-2026-117469 · GHSA-jg7j-q6m4-7gq5

Psono file-transfer confusion allows unauthorized repository writes

LOW 24

Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00337 Published 2026-10-27 Fixed in 7.2.4 CWE-862

TI-2026-81015 CVE-2026-117468 · GHSA-897w-6p63-7p9g

Device-code claim permits restricted token escalation in Psono Server

LOW 29

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00468 Published 2026-10-27 Fixed in 7.2.4 CWE-269

TI-2025-01732 CVE-2025-1987 · GHSA-gh4q-cm74-fv2j

Stored XSS in Psono-Client via Malicious Vault Entry URLs

MEDIUM 49

A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass.

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00569 Published 2025-06-21 Fixed in 0.0.76, 1.1.18 +2 CWE-79