CVE-2026-117470
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticat
CVSS
6.5
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Oct 27, 2026 · Last modified: Oct 27, 2026 · CWE-294
Not enough EPSS history yet.
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
- gitlab.comhttps://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117470.md
- gitlab.comhttps://gitlab.com/esaqa/psono/psono-server
- gitlab.comhttps://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/webauthn_verify.py
- gitlab.comhttps://gitlab.com/esaqa/psono/psono-server/-/commit/9c9a7f1701535df63370340dcc80210737dc495d
- gitlab.comhttps://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-104381——
———A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.6hCVE-2026-410207.5 HIG—
———Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.6hCVE-2026-1168256.5 MED—
——0YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.22hCVE-2026-892096.8 MED—
——0A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.1dCVE-2026-1162018.8 HIG22.9%
——7Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.1dCVE-2026-658247.4 HIG16.6%
——5OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.1d