CVE-2026-117468 Device-code claim permits restricted token escalation in Psono Server
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-117468?
CVE-2026-117468 is a medium-severity vulnerability in esaqa GmbH Psono, published on 27 Oct 2026.
Official description
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Weakness: CWE-269
Which versions are affected by CVE-2026-117468?
How do I fix CVE-2026-117468?
No fix has been published for CVE-2026-117468 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-117468 being exploited?
There is no known exploitation of CVE-2026-117468 in the wild and no public exploit code.
Sources
Also known as GHSA-897w-6p63-7p9g.