c686b701dd/api/oauth_tokens skipped the scope check, so a token with any scope could list the user's sessions and revoke them.
1 line
138 B
Text
1 line
138 B
Text
Require the read:security and write:security scopes to list and revoke OAuth tokens (HTTP Basic auth no longer works for these endpoints)
|