From 9e4329ebfc62416f61316a07d0dfe18e29f332db Mon Sep 17 00:00:00 2001
From: James Cole <james@firefly-iii.org>
Date: Mon, 27 Apr 2026 18:05:39 +0200
Subject: [PATCH] Update changelog.

---
 changelog.md   | 18 ++++++++++++++++++
 routes/web.php |  3 +++
 2 files changed, 21 insertions(+)

diff --git a/changelog.md b/changelog.md
index 26804f35f7..47f3793cd1 100644
--- a/changelog.md
+++ b/changelog.md
@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## v6.6.2 - 2026-04-28
+
+<!-- summary: This releases fixes a security issue and some small UI issues. Please upgrade at your earliest convenience. -->
+
+### Added
+
+- #12179
+- #12182
+
+### Fixed
+
+- #12169
+- #12186
+
+### Security
+
+- Fixed an issue where oAuth tokens could be generated before you confirmed your 2FA state. This would allow access to your data when your password was stolen, despite you having MFA enabled.
+
 ## v6.6.1 - 2026-04-19
 
 <!-- summary: This releases upgrades many dependencies and will invalidate all of your OAuth-tokens and clients. -->
diff --git a/routes/web.php b/routes/web.php
index d98f3d10ec..f63bac52c6 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -387,6 +387,9 @@ Route::group(
     }
 );
 
+
+
+
 // exchange rates controller
 Route::group(
     ['middleware' => 'user-full-auth', 'namespace' => 'FireflyIII\Http\Controllers\ExchangeRates', 'prefix' => 'exchange-rates', 'as' => 'exchange-rates.'],