Token Scope Bypass in Psono Server by Psono

CVE-2026-117468

What is CVE-2026-117468?

In Psono Server versions ranging from 5.3.5 to 7.2.3, a vulnerability exists within the permission class that fails to adequately enforce the token write scope during device code claiming. This flaw allows an authenticated remote attacker, who holds a session derived from a limited API key, to successfully claim a device code controlled by them. Consequently, the attacker can establish a persistent read-write session that remains valid for up to 365 days, thereby circumventing the intended scope and lifetime regulations of the original token. Importantly, this vulnerability does not bypass two-factor authentication nor does it directly reveal plaintext secrets.

References