GHSA-jghc-wgvq-4r28: 
Rust 취약점 분석 및 완화

Access tokens issued to an OAuth client were indistinguishable from user session tokens. Endpoints that require a signed-in user accepted them, and a client's registered scope constrained only the token's scope string. A registered client could therefore act with user-session authority. Tokens issued to a client are now bound to the client and refused by session endpoints, and a client is granted only its registered scopes. Integrators with routes meant for delegated access should use the delegated-token validation added in the fixed releases. All affected versions are already yanked. Behaviour change in the fixed releases: session endpoints refuse client-issued tokens, and /oauth/authorize refuses unregistered scopes (invalid_scope). Tokens issued before the upgrade carry no client binding and remain accepted until they expire. Versions before 0.4.0 were not examined.