Sony PS5 Mystery Solved: Strange Unauthorized Games Disappearing from PSN Accounts
Sony Confirms PS5 Account Hijacking Bug—Here’s How It Happened and What Developers Need to Know
Sony has quietly patched a critical PS5 authentication flaw that allowed unauthorized access to user accounts, inserting third-party game titles into PSN profiles without consent. The bug, first reported by DailyGame and confirmed by Sony via a June 17 internal update, stems from a misconfigured OAuth2 token validation in the PS5’s PlayStation Network API. According to reverse-engineering logs shared with PS5-Dev GitHub, the vulnerability exploited a JWT signature bypass in the psn_auth_v2 endpoint, granting attackers session persistence even after password resets.
The Tech TL;DR:
- Security Risk: Unauthorized game installations via hijacked PSN accounts—no admin privileges required. Attackers used
PSN::InstallGameAPI calls with spoofed session tokens. - Enterprise Impact: Sony’s patch (version
PS5-SW-2026.06.17) requires a full OS rollback to 12.0.6, forcing IT admins to audit managed gaming server deployments for exposed endpoints. - Developer Workaround: Sony’s official SDK update mandates HMAC-SHA256 token validation for third-party apps. Legacy codebases must recompile against
libpsn-auth-v3.so.
Why Sony’s PS5 Bug Exposes a Broader OAuth2 Flaw in Consumer Hardware
The root cause lies in Sony’s custom JWT implementation, which deviated from RFC 7519 by omitting alg claims in token headers. This allowed attackers to craft valid signatures using RS256 keys leaked from earlier PS4 exploits (CVE-2021-40560). According to BleepingComputer’s analysis, the attack chain began with a CSRF vulnerability in the PS5 web dashboard, redirecting users to a malicious OAuth2 flow hosted on a compromised psn-auth.example.com domain.
— Alex Hutton, CTO of GamerShield, a PSN penetration testing firm:
“This isn’t just a PS5 issue—it’s a textbook case of protocol drift in consumer IoT. Sony’s deviation from standard OAuth2 practices created a blast radius that extends to any device using their custom auth library. The fix? Enforce strict token binding via
subclaims and short-lived refresh tokens—something enterprise SSO systems have done for years.”
How the Exploit Worked: A Step-by-Step Breakdown
Attackers leveraged three vectors:
- Token Theft: Exploited a
GET /psn/auth/tokenendpoint that returned unencrypted JWTs in HTTP responses (visible in network traces). - Session Hijacking: Used stolen tokens to call
POST /psn/store/install, installing games without user interaction. Sony’s support logs show cases where users reported “mysterious” game installations with no purchase history. - Persistence: Abused the
PSN::SessionKeepAliveAPI to maintain access even after password changes, as the token’sexpclaim was ignored server-side.
The Patch: What Developers Need to Deploy Now
Sony’s fix (PS5-SW-2026.06.17) includes:
- Strict JWT Validation: Enforces
alg: RS256andtyp: JWTheaders, rejecting malformed tokens. - Token Binding: Adds
subclaim validation tied to the user’sPSN::UserID. - Rate Limiting: Caps
/psn/store/installcalls to 3 requests/hour per session.
However, the patch breaks backward compatibility with pre-2024 SDK versions. Developers must update to psn-sdk-v4.2.1 and recompile using:
gcc -o psn_app main.c -lpsn-auth-v3 -I/path/to/psn_sdk/include -L/path/to/psn_sdk/libFor enterprises managing PSN-integrated applications, cybersecurity auditors recommend immediate static analysis of OAuth2 flows using tools like OWASP Amass to detect similar misconfigurations.
Who’s Affected? The Blast Radius Beyond PS5
While Sony’s patch mitigates the immediate risk, the underlying OAuth2 misconfiguration persists in:
- PS4 (Legacy Systems): Unpatched consoles remain vulnerable. Sony has not released a fix for PS4, leaving retro gaming server operators exposed.
- Third-Party Apps: Any application using Sony’s
psn-auth-v1/v2libraries must upgrade tov3. Indie developers relying on unofficial SDKs (e.g., psxdev’s repo) face critical deadlines. - Enterprise Integrations: Companies using PSN for gamified employee engagement (e.g., via HR tech platforms) must audit their
OAuth2Clientconfigurations.
How to Audit Your PSN/OAuth2 Implementation: A CLI Checklist
Use these commands to verify your system’s exposure:
# 1. Check for unencrypted JWTs in responses
curl -v -X GET "https://psn.example.com/auth/token?code=STOLEN_CODE" | grep -i "Authorization: Bearer"
# 2. Test token binding (should return 403 if sub claim is missing)
curl -X POST "https://psn.example.com/store/install"
-H "Authorization: Bearer MALFORMED_JWT"
-H "Content-Type: application/json"
-d '{"gameId": "SP001"}'
# 3. Validate SDK version (must be >= v4.2.1)
strings /path/to/your/app | grep "psn-sdk"For deeper analysis, penetration testing firms like GamerShield offer OAuth2-specific audits starting at $5,000/month.
What Happens Next: The Trajectory of Sony’s Auth Overhaul
Sony’s response suggests a broader shift toward standardized authentication protocols. In a June 18 internal memo (leaked to IGN), the company announced:
- Mandatory OAuth2.1 Adoption: All new PSN integrations must use RFC 9101-compliant flows by Q4 2026.
- Hardware-Backed Tokens: Future consoles will use PS5’s NPU for cryptographic operations, eliminating server-side validation gaps.
- Third-Party Audits: Sony will require SOC 2 Type II compliance for all PSN-connected services by 2027.
For developers, this means two critical deadlines:
- June 2026: Patch to
psn-sdk-v4.2.1and enable token binding. - Q4 2026: Migrate to OAuth2.1 or risk deprecation.
Enterprises should engage PSN compliance consultants now to avoid service disruption during the transition.
*Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.*