CVE-2026-117468Medium· 6.5▾ SunlitPsono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
Psono >= 5.3.5 < 7.2.4Upgrade to Psono Server 7.2.4 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117470Medium· 6.5WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-117472Medium· 4.3URL prefix handling permits API key read-scope bypass in Psono Server
CVE-2026-117471Medium· 5.4User-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2026-117469Medium· 5.4File-transfer type confusion permits unauthorized repository writes in Psono Server
CVE-2018-16497High· 7.8In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server
CVE-2021-20021Critical· 9.8A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.