hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pleroma/changelog.d/oauth-tokens-scopes.security

1 line
138 B
Text
Raw Normal View History

fix(oauth): require security scopes to list and revoke tokens /api/oauth_tokens skipped the scope check, so a token with any scope could list the user's sessions and revoke them.
2026-10-26 12:21:47 +04:00
Require the read:security and write:security scopes to list and revoke OAuth tokens (HTTP Basic auth no longer works for these endpoints)
Reference in a new issue Copy permalink