Yuvomi

Security

• A scoped API token can no longer reach the account-management routes to escape its own scope (GHSA-xcv5-6w6x-x5q2). The auth router is mounted ahead of the global scope, guest and module gates so that login, first-run setup and the OIDC handshake stay reachable without a session - but that placement also meant none of those gates ran for /api/v1/auth/*. A token restricted to a single read scope, acting as an admin subject, could therefore create a new unscoped token or a new admin user and so defeat the least-privilege boundary that scoping exists to provide. The router now re-checks scope at its own entry: a scoped token (including one scoped to nothing) is refused on every auth route, while unscoped legacy tokens and interactive sessions are unaffected.