/api/oauth_tokens skipped the scope check, so a token with any scope could list the user's sessions and revoke them.
Lain Soykaf