https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 01:37:27 +0000 https://db.gcve.eu/vuln/cve-2026-117468 <p><strong>Affected:</strong> esaqa GmbH Psono</p> <p>Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token&#39;s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.</p> <p><strong>Affected:</strong> esaqa GmbH Psono</p> <p>Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token&#39;s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.</p> https://db.gcve.eu/vuln/cve-2026-117468