Description
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Published: 2026-10-27
Score: 6.5 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to Psono Server 7.2.4 or later.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
References

Tue, 27 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Description Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Title Device-code claim permits restricted token escalation in Psono Server
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: esaqa

Published:

Updated: 2026-10-27T05:59:08.920Z

Reserved: 2026-10-27T05:33:18.001Z

Link: CVE-2026-117468

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T06:17:24.527

Modified: 2026-10-27T06:17:24.527

Link: CVE-2026-117468

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses