CVE-2026-117468— Device-code claim permits restricted token escalation in Psono Server

Quick assessment

Affected

esaqa GmbH Psono

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Psono Server 5.3.5 至 7.2.3 版本中使用的权限类在申领设备代码（device code）时未强制执行令牌写入范围（token write scope）。持有受限 API 密钥派生会话的已认证远程攻击者，可以申领由攻击者控制的设备代码，从而获取一个有效期最长可达 365 天的完整读写会话。该漏洞绕过了原始令牌的范围和生命周期限制，但并未绕过双因素认证，也未直接泄露明文密钥。

CVSS 6.5 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 3 AI

T1098 · Account Manipulation T1558.001 · Golden Ticket T1551.006

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Device-code claim permits restricted token escalation in Psono Server

Source: CVE Program / CVE List V5

Vulnerability Description

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
esaqa GmbH	Psono	5.3.5 ~ 7.2.4	-

II. Public POCs for CVE-2026-117468

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117468

请登录查看更多情报信息。

Other References for CVE-2026-117468 (5)

https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/views/device_code_claim.py technical-description
https://gitlab.com/esaqa/psono/psono-server/-/commit/19ed5a192c704fece1645d946b6f4c36045bacbe patch
https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117468.md vendor-advisory
https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 release-notes
https://gitlab.com/esaqa/psono/psono-server product

https://www.cve.org/CVERecord?id=CVE-2026-117468

Same Patch Batch · esaqa GmbH · 2026-10-27 · 5 CVEs total

CVE-2026-117470	6.5 MEDIUM	WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-117471	5.4 MEDIUM	User-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2026-117469	5.4 MEDIUM	File-transfer type confusion permits unauthorized repository writes in Psono Server
CVE-2026-117472	4.3 MEDIUM	URL prefix handling permits API key read-scope bypass in Psono Server

IV. Related Vulnerabilities

Same product: Psono

Same vendor: esaqa GmbH

Same weakness: CWE-269