CVE-2026-57458: Vikunja: Scoped API token can mint unrestricted OAuth session credentials

A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials.

A token limited to:

{"oauth":["authorize"]}

can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obtain a normal bearer JWT plus refresh token. The resulting credentials are not restricted by the original API-token permissions.