Description
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
esaqa GmbH Psono
Default version status: unaffected
5.3.5 to < 7.2.4affected
References
- https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/views/device_code_claim.py ↗
- https://gitlab.com/esaqa/psono/psono-server/-/commit/19ed5a192c704fece1645d946b6f4c36045bacbe ↗
- https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 ↗
- https://gitlab.com/esaqa/psono/psono-server ↗
- https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117468.md ↗