CVE-2026-117468

Psono Server versions 5.3.5 through 7.2.3 are vulnerable to a restricted token escalation due to a permission class that fails to enforce token write scope when claiming a device code. An authenticated remote attacker with a restricted API key-derived session can claim an attacker-controlled devi...