Getting this error in https://github.com/openzim/mwoffliner/issues/2401 trying to parse https://de.wikipedia.org/wiki/Liste_der_Schlangenarten using Parsoid:
https://de.wikipedia.org/w/api.php?action=parse&format=json&prop=text&parsoid=1&page=Liste_der_Schlangenarten

In T395525#10866731, @Umherirrender wrote:

There is no way to preserve the random value from generator to the output.

The typo should actually be rest.php/oauth2?grant_type=

I have just tested it and this issue exists for mwoauth-authonlyprivate as well, allowing the consumer to keep accessing my email address without me being aware of it or having any way to prevent it.

Security-Team I have found an abuse vector for this issue. While the new access tokens are invalid for editing the wiki, they are still valid for the identify endpoint oauth2/resource/profile.

In T336113#8983811, @Tgr hat geschrieben:

I don't think there's a straightforward way of doing this. RefreshTokenRepository is a CacheRepository subclass so you can only delete if you know the token ID. We'd need to be able to delete by acceptance ID.

In T340921#8984284, @gerritbot wrote:

Change 934713 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OAuth@master] Fix default refresh token expiry

https://gerrit.wikimedia.org/r/934713

While I can't see a clear abuse vector due to the Cannot create access token, user did not approve issuing this access token error, this still feels a lot like a security issue. Therefore I'm escalating just to be sure.

I think having edits to abuse filter hidden from recent changes is problematic for admins. It's currently possible that admins will never notice the existence of new filters which might cause problems later on. Trying to solve issues of editors is also made a lot harder when admins don't know that there was a recent abuse filter change which causes the issue.

Wouldn't returning a permissions error be the better message? That message should already exist as well and the user is in fact missing the permission to protect to that level.