The specific steps are as follows:
0. Share your own feed token on test wiki.

1. Block yourself on testwiki.
2. Visit https://w.wiki/35Bb .
3. You can see:

Your username or IP address has been blocked.

The block was made by ‪yourself. The reason given is test for T277009

Start of block: just now
Expiration of block: […]
Intended blockee: ‪yourself
You can contact yourself‬ or another administrator to discuss the block. You can use the "Email this user" feature if a valid email address is specified in your preferences and you have not been blocked from using it. Your current IP address is […], and the block ID is #[…]. Please include all above details in any queries you make.

And you can't reset your key because it's overwritten by block notice, It cannot be modified under any circumstances.

And you can't reset your key because it's overwritten by block notice.

Why would you want to reset your token if you are blocked anyway?
How is that a security issue, see https://www.mediawiki.org/wiki/Reporting_security_bugs#What_is_Considered_A_Security_Issue ?
Please read my previous comment, which asked for "what you expected to happen instead and why you think that is a Security problem".

In T277009#6899506, @Aklapper wrote:

And you can't reset your key because it's overwritten by block notice.

Why would you want to reset your token if you are blocked anyway?
How is that a security issue, see https://www.medi%61wiki.org/wiki/Reporting_security_bugs#What_is_Considered_A_Security_Issue ?
Please read my previous comment, which asked for "what you expected to happen instead and why you think that is a Security problem".

Because the token has already been shared. This is a security issue because the user's token is already publicly visible but he doesn't have the ability to reset the token, because he happens to be blocked. In other words, If the token of a blocked user is made public, the blocked user cannot change the token in any case.

In T277009#6899512, @IN wrote:

Because the token has already been shared. This is a security issue because the user's token is already publicly visible

@IN: Where exactly is the token publicly visible to someone who is not the user themselves? Where can I see your token, basically? Please follow https://www.mediawiki.org/wiki/How_to_report_a_bug and provide complete steps to reproduce some situation. Thanks.

@IN: You linked to https://test.wikipedia.org/w/index.php?title=Special:ResetTokens&returnto=Special%3APreferences&uselang=en (please avoid obfuscating links).
That page says "You can reset tokens which allow access to certain private data associated with your account here. You should do it if you accidentally shared them with someone or if your account has been compromised." I do not see a Security issue here, but a Privacy issue. If you see a Security issue, then please see https://www.mediawiki.org/wiki/Reporting_security_bugs#What_is_Considered_A_Security_Issue and explain what the Security issue is. Thanks.

We should definitely allow blocked users to use Special:ResetTokens. I'm not sure exactly if I'd consider it a Vuln-Infoleak since it relies on the watchlist token being distributed/compromised but it's something we should allow for. I think this was accidental rather than intentional, it just uses the default from FormSpecialPage.

In T277009#6899764, @Aklapper wrote:

In T277009#6899512, @IN wrote:

Because the token has already been shared. This is a security issue because the user's token is already publicly visible

@IN: Where exactly is the token publicly visible to someone who is not the user themselves? Where can I see your token, basically? Please follow https://www.mediawiki.org/wiki/How_to_report_a_bug and provide complete steps to reproduce some situation. Thanks.

Watchlist tokens allow access to your watchlist, so you can use them for RSS feeds, or even have a shared watchlist amongst multiple users. The token should be unguessable, but the more likely scenario here is that you share it with someone or accidentally leak it and need to reset it. Special:ResetTokens is the way to do that, except it currently disallows blocked users from using it.

Patch:

In T277009#6901149, @matmarex wrote:

Patch:

0001-Allow-blocked-users-to-access-Special-ResetTokens.patch930 BDownload

Code-Review +2

In T277009#6901149, @matmarex wrote:

Patch:

0001-Allow-blocked-users-to-access-Special-ResetTokens.patch930 BDownload

(I can submit to Gerrit instead if this isn't considered a security issue)

Untested, but makes sense - assuming that Jenkins wouldn't object, +2 from me - not sure if this needs to be deployed as a security patch or can go through gerrit, I think gerrit would be fine (please add me as a reviewer if done on gerrit)

https://gerrit.wikimedia.org/r/c/mediawiki/core/+/670546

I feel like this doesn't need a pick/deploy to wmf.34 and can wait until next week, unless anyone has more serious concerns.

I think this task should be a feature request, not a security issue. Can someone change it to FEATURE?

Because it's really a privacy issue, so please do not expose this task until a new version is released. After the new version is released, the task is over, so it can be make public.

In T277009#6903536, @IN wrote:

I think this task should be a feature request, not a security issue. Can someone change it to FEATURE?

It's a lightweight user Vuln-DoS so we can keep the Security label.

Because it's really a privacy issue, so please do not expose this task until a new version is released. After the new version is released, the task is over, so it can be make public.

Yes, we can keep this task protected probably until Thursday of next week, after c954cc85ea is cut with wmf.35 and makes it to all wiki groups. The gerrit change set is already public, of course, but this is low-risk enough imo, and the change set discreet enough, that it shouldn't be problematic.

Is this mission over now?

@IN: ? What "mission"?
Was that a question whether to resolve this ticket now that https://gerrit.wikimedia.org/r/c/mediawiki/core/+/670546 has been merged?