CVE-2026-63198: traQ: Privilege escalation by OAuth prompt=none request

In OAuth2 silent authorization (`prompt=none`), when the `scope` parameter was empty or omitted, all scopes registered for the OAuth client became eligible for issuance. However, the prior consent check was performed against the empty requested scope set. As a result, an attacker could obtain an access token with broader scopes than the user had previously consented to, without requiring additional consent. ## Impact If an attacker controls an OAuth client capable of receiving authorization codes, and a user has already consented to only a subset of that client’s scopes, the attacker may be able to obtain a token containing all scopes registered for that client by sending an authorization request with `prompt=none` and an empty or omitted `scope`. If the user has not consented to the client at all, `consent_required` is returned as usual. ## Patches This issue has been fixed in v3.28.3. After the fix, the consent check for `prompt=none` verifies the scopes that will actually be issued, rather than the empty requested scope set. If the user has not consented to all scopes after expansion, `consent_required` is returned. traQ also recommends revoking any existing OAuth tokens created before the fix if they were potentially affected. ## Workarounds If users cannot update immediately, they should apply the following mitigations: - Disable untrusted OAuth clients, minimize registered client scopes, and revoke existing tokens - Reject authorization requests with `prompt=none` where `scope` is empty or omitted