CVE-2026-117468 Device-code claim permits restricted token escalation in Psono Server

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session...

CVE-2026-117468

Psono Server versions 5.3.5 through 7.2.3 are vulnerable to a restricted token escalation due to a permission class that fails to enforce token write scope when claiming a device code. An authenticated remote attacker with a restricted API key-derived session can claim an attacker-controlled devi...