Fix for #650

src/Grant/ImplicitGrant.php

@@ -151,6 +151,14 @@ class ImplicitGrant extends AbstractAuthorizeGrant
                 : $client->getRedirectUri()
         );
         
+        // Finalize the requested scopes
+        $scopes = $this->scopeRepository->finalizeScopes(
+            $scopes,
+            $this->getIdentifier(),
+            $client,
+            $authCodePayload->user_id
+        );
+
         $stateParameter = $this->getQueryStringParameter('state', $request);
 
         $authorizationRequest = new AuthorizationRequest();