{'code': 'badtoken',
 'info': 'Invalid CSRF token.',
 'other': {'help': 'See https://de.wikipedia.org/w/api.php for API usage. '
                   'Subscribe to the mediawiki-api-announce mailing list at '
                   '<https://lists.wikimedia.org/postorius/lists/mediawiki-api-announce.lists.wikimedia.org/> '
                   'for notice of API deprecations and breaking changes.',
           'servedby': 'mw1376'},
 'unicode': 'badtoken: Invalid CSRF token.\n'
            '[servedby: mw1376;\n'
            ' help: See https://de.wikipedia.org/w/api.php for API usage. '
            'Subscribe to the mediawiki-api-announce mailing list at '
            '<https://lists.wikimedia.org/postorius/lists/mediawiki-api-announce.lists.wikimedia.org/> '
            'for notice of API deprecations and breaking changes.]'}

at line 406, here is the data:
    self.action = 'login'
    login_result = {
        'warnings': {
            'main': {
                '*': 'Subscribe to the mediawiki-api-announce mailing list at [deleted] for notice of API deprecations and breaking changes.'
            },
            'login': {
                '*': 'Fetching a token via "action=login" is deprecated. Use "action=query&meta=tokens&type=login" instead.'
            }
         },
        'login': {
            'result': 'NeedToken',
            'token': '2728dc3bff180ef48b90f3ee132e1cdc63dd8091+\\'
        }
    }

    and, significantly,

    self.site.tokens = {} (which I see is really a TokenWallet)

on line 430, this leads to an exception on my installation. I observed that the needed token is already in the response, which is why I made the change I did.

% pwb login
>>>RJC>>> APISite.version()
>>>RJC>>> SiteInfo._get_general(key=generator, expiry=1 day, 0:00:00
>>>RJC>>> general not in self._cache
>>>RJC>>> forcing
>>>RJC>>> props: ['namespaces', 'namespacealiases', 'general']
>>>RJC>>> SiteInfo._get_siteinfo(prop=['namespaces', 'namespacealiases', 'general'], expiry=1 day, 0:00:00)
>>>RJC>>> request: /w/api.php?action=query&meta=siteinfo&siprop=namespaces|namespacealiases|general&continue=
WARNING: API error readapidenied: You need read permission to use this module.
>>>RJC>>> Caught APIError: readapidenied: You need read permission to use this module.
[help: See https://MYWIKI/w/api.php for API usage. Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/mailman/listinfo/mediawiki-api-announce> for notice of API deprecations and breaking changes.]
>>>RJC>>> No read persmissions
ERROR: You have no API read permissions. Seems you are not logged in.
Logging in to my_family:en as me@me_bot
WARNING: API warning (main): Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/mailman/listinfo/mediawiki-api-announce> for notice of API deprecations and breaking changes.
WARNING: API warning (login): Fetching a token via "action=login" is deprecated. Use "action=query&meta=tokens&type=login" instead.
>>>RJC>>> self.action: login
>>>RJC>>> login_result: {'warnings': {'main': {'*': 'Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/mailman/listinfo/mediawiki-api-announce> for notice of API deprecations and breaking changes.'}, 'login': {'*': 'Fetching a token via "action=login" is deprecated. Use "action=query&meta=tokens&type=login" instead.'}}, 'login': {'result': 'NeedToken', 'token': 'f71af5fc300dbd72908ede7648441f0263e120a0+\\'}}
ERROR: Received incorrect login token. Forcing re-login.
>>>RJC>>> TokenWallet.__getitem__(login)
>>>RJC>>> self.site.user(): None
>>>RJC>>> self._currentuser: None
>>>RJC>>> self._tokens: {}
>>>RJC>>> calling self.site.get_tokens([])
>>>RJC>>> APISite.get_tokens([])
>>>RJC>>> not type or load_all not false
>>>RJC>>> ParamInfo.parameter(module=query+tokens, param_name=type
>>>RJC>>> ParamInfo.fetch({'query+tokens'}
>>>RJC>>> self._paraminfo: {}
>>>RJC>>> calling self._init()
>>>RJC>>> ParamInfo._init()
>>>RJC>>> self._modules: {}
>>>RJC>>> APISite.version()
>>>RJC>>> SiteInfo._get_general(key=generator, expiry=1 day, 0:00:00
>>>RJC>>> general not in self._cache
>>>RJC>>> forcing
>>>RJC>>> props: ['namespaces', 'namespacealiases', 'general']
>>>RJC>>> SiteInfo._get_siteinfo(prop=['namespaces', 'namespacealiases', 'general'], expiry=1 day, 0:00:00)
>>>RJC>>> request: /w/api.php?action=query&meta=siteinfo&siprop=namespaces|namespacealiases|general&continue=
WARNING: API error readapidenied: You need read permission to use this module.
>>>RJC>>> Caught APIError: readapidenied: You need read permission to use this module.

API Error: query=
("{'action': ['query'], 'meta': ['siteinfo', 'userinfo'], 'siprop': "
 "['namespaces', 'namespacealiases', 'general'], 'continue': [True], 'uiprop': "
 "['blockinfo', 'hasmsg'], 'maxlag': ['5'], 'format': ['json']}")
           response=
{'error': {'code': 'readapidenied', 'info': 'You need read permission to use this module.', 'servedby': 'mw1402', 'help': 'See https://xxxx.wikimedia.org/w/api.php for API usage. Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/postorius/lists/mediawiki-api-announce.lists.wikimedia.org/> for notice of API deprecations and breaking changes.'}, 'servedby': 'mw1402'}
ERROR: You have no API read permissions. Seems you are not logged in.
ERROR: Username 'xxx@xxx' does not have read permissions on xxx:xxx
Not logged in on xxx:xxx.

import pywikibot
from pywikibot import config
config.debug_log = ['']
site = pywikibot.Site(<your private wiki site>)
site.login()  # or site.login(user=<account name>)

$ python pwb.py version -v
Pywikibot: [https] r-pywikibot-core.git (d703ece, g17791, 2023/02/23, 13:17:51, stable)
Release version: 8.0.0
setuptools version: 67.3.2
mwparserfromhell version: 0.6.4
wikitextparser version: n/a
requests version: 2.28.2
  cacerts: (...)\cacert.pem
    certificate test: ok
Python: 3.11.2