Live › vulnerability › CVE-2026-117468
Go to dashboardPsono Server versions 5.3.5 through 7.2.3 do not check token write scope when a device code is claimed. An authenticated attacker holding a restricted API key session can claim an attacker-controlled device code and get a full read-write session valid up to 365 days.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 06:25 UTC. All times on this page are UTC.
Self-hosted or managed Psono Server deployments running versions 5.3.5 through 7.2.3 that issue restricted API keys. The attacker needs an authenticated session derived from a restricted API key, and the flaw does not bypass two-factor authentication or directly disclose plaintext secrets. Deployments that do not use restricted API keys have a much smaller exposure.
No product ranges from the sources yet.
7.2.3 (the exact fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-117468")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.