diff --git a/src/Exception/OAuthServerException.php b/src/Exception/OAuthServerException.php
index 6ffa0fb1..6cd82bb3 100644
--- a/src/Exception/OAuthServerException.php
+++ b/src/Exception/OAuthServerException.php
@@ -105,7 +105,10 @@ class OAuthServerException extends \Exception
     public static function invalidScope($scope, $redirectUri = null)
     {
         $errorMessage = 'The requested scope is invalid, unknown, or malformed';
-        $hint = sprintf('Check the `%s` scope', $scope);
+        $hint = sprintf(
+            'Check the `%s` scope',
+            htmlspecialchars($scope, ENT_QUOTES, 'UTF-8', false)
+        );
 
         return new static($errorMessage, 5, 'invalid_scope', 400, $hint, $redirectUri);
     }