Psono Server versions 5.3.5 through 7.2.3 contain a vulnerability where a permission class fails to enforce token write scope when claiming a device code. An authenticated attacker with a restricted API key-derived session can claim a device code they control and escalate to a full read-write session valid for up to 365 days. This escalation bypasses the original token's scope and lifetime restrictions but does not bypass two-factor authentication or disclose plaintext secrets.