CVE-2026-117468: Device-code claim permits restricted token escalation in Psono Server
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Psono Serverto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
Which deployments are affected?
Psono Server versions 5.3.5 through 7.2.3 are affected. The issue is fixed in version 7.2.4.
What access does an attacker need to exploit this?
An attacker needs an authenticated remote session derived from a restricted API key. They also need to claim an attacker-controlled device code.
What is the impact of successful exploitation?
The attacker can obtain a full read-write session valid for up to 365 days, bypassing the restricted API key session's original scope and lifetime limits. The issue does not bypass two-factor authentication or directly reveal plaintext secrets.
What can be done if upgrading is not immediately possible?
The provided information does not identify a configuration workaround. Restricting or rotating API keys that could be used to create restricted API key-derived sessions may reduce exposure until an upgrade to 7.2.4 is possible.