Escape scope parameter to reduce pontential XSS vector

src/Exception/OAuthServerException.php

@@ -105,7 +105,10 @@ class OAuthServerException extends \Exception
     public static function invalidScope($scope, $redirectUri = null)
     {
         $errorMessage = 'The requested scope is invalid, unknown, or malformed';
-        $hint = sprintf('Check the `%s` scope', $scope);
+        $hint = sprintf(
+            'Check the `%s` scope',
+            htmlspecialchars($scope, ENT_QUOTES, 'UTF-8', false)
+        );
 
         return new static($errorMessage, 5, 'invalid_scope', 400, $hint, $redirectUri);
     }