https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 00:25:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-117468 <p>Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token&#39;s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.</p> <p>Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token&#39;s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.</p> https://db.gcve.eu/vuln/fkie_cve-2026-117468 https://db.gcve.eu/vuln/ghsa-897w-6p63-7p9g <p>Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token&#39;s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.</p> <p>Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token&#39;s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.</p> https://db.gcve.eu/vuln/ghsa-897w-6p63-7p9g