CVE-2026-117468 Details
Description
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
A vulnerability in Psono Server was identified, affecting versions 5.3.5 through 7.2.3. The issue arises from a permission class that failed to properly enforce token write scope when claiming a device code. This flaw allows an authenticated remote attacker with a restricted API key-derived session to claim a device code and gain a full read-write session valid for up to 365 days, circumventing the original token's scope and lifetime limitations. Notably, this vulnerability does not bypass two-factor authentication or directly reveal plaintext secrets.
Users can update to Psono Server version 7.2.4, which addresses this vulnerability by restoring proper token scope enforcement during the device code claim process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117468.md | fdf66990-8419-4c8c-8848-ec15d75773b4 | AdvisoryBroken Link |
| https://gitlab.com/esaqa/psono/psono-server | fdf66990-8419-4c8c-8848-ec15d75773b4 | Vendor |
| https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/views/device_code_claim.py | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/commit/19ed5a192c704fece1645d946b6f4c36045bacbe | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 | fdf66990-8419-4c8c-8848-ec15d75773b4 | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | fdf66990-8419-4c8c-8848-ec15d75773b4 |
Affected Products
| Product | Versions |
|---|---|
| Psono Server | >= 5.3.5, <= 7.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | fdf66990-8419-4c8c-8848-ec15d75773b4 |