Psono Server CE & EE versions 3.1.0 through 7.2.3 contain a vulnerability where the WebAuthn challenge is not consumed after assertion verification. This allows an attacker who has the user's password and a captured valid WebAuthn assertion to replay the assertion with different login tokens, bypassing the WebAuthn second factor. The attack requires prior capture of a valid assertion and does not expose plaintext secrets.