Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by esaqa

CVE-2026-117468Device-code claim permits restricted token escalation in Psono Server

Medium 6.5

In plain English

A medium-severity privilege mismanagement in Psono from esaqa GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.

Affected products (as reported)

VendorProductVersions
esaqa GmbH Psono 5.3.5 – before 7.2.4

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References