AIKIDO-2026-10265

TL;DR

Affected versions of this package allowed @use_request_token(scope="...") to be applied without explicitly setting required, which previously defaulted to False and silently allowed token-less requests to pass through, creating a misleading access-control footgun. An attacker could exploit this by calling endpoints decorated with @use_request_token(...) without providing any token, bypassing the intended token-gated protection and reaching privileged handlers to read sensitive data or trigger unauthorized state-changing actions, depending on what those routes expose.