diff --git a/changelog.md b/changelog.md
index 26804f35f7..47f3793cd1 100644
--- a/changelog.md
+++ b/changelog.md
@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## v6.6.2 - 2026-04-28
+
+<!-- summary: This releases fixes a security issue and some small UI issues. Please upgrade at your earliest convenience. -->
+
+### Added
+
+- #12179
+- #12182
+
+### Fixed
+
+- #12169
+- #12186
+
+### Security
+
+- Fixed an issue where oAuth tokens could be generated before you confirmed your 2FA state. This would allow access to your data when your password was stolen, despite you having MFA enabled.
+
 ## v6.6.1 - 2026-04-19
 
 <!-- summary: This releases upgrades many dependencies and will invalidate all of your OAuth-tokens and clients. -->
diff --git a/routes/web.php b/routes/web.php
index d98f3d10ec..f63bac52c6 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -387,6 +387,9 @@ Route::group(
     }
 );
 
+
+
+
 // exchange rates controller
 Route::group(
     ['middleware' => 'user-full-auth', 'namespace' => 'FireflyIII\Http\Controllers\ExchangeRates', 'prefix' => 'exchange-rates', 'as' => 'exchange-rates.'],