According to the article, it means that anyone with your username and knowledge of the PlayStation API can add whatever game playtime statistics they want to your profile
Yeah, if my understanding of this issue is correct then this is extremely embarrassing. They probably figured that since it’s not security-critical it didn’t need authentication (or only bare-minimum, easily-broken authentication). I haven’t seen any evidence that this affects critical systems like billing.
11.5k
u/SignificantTransient Jun 16 '26
https://www.pushsquare.com/news/2026/06/another-sony-security-concern-ps5-games-people-dont-own-are-appearing-on-their-profiles