Insufficient restrictions on the creation of new API keys allow a scoped API key or OAuth2 token with key-creation permissions to bypass scopes, allow lists, and expiry limits. By calling the 'POST /api/v2/users/{user}/keys/tokens' endpoint, an attacker can generate longer-lived keys with `coder:all` permissions, effectively gaining the full privileges of the user.