diff --git a/src/Http/FormAuthenticationHook.php b/src/Http/FormAuthenticationHook.php
index <HASH>..<HASH> 100644
--- a/src/Http/FormAuthenticationHook.php
+++ b/src/Http/FormAuthenticationHook.php
@@ -36,10 +36,6 @@ class FormAuthenticationHook implements BeforeHookInterface
             if ('/_form/auth/verify' === $request->getPathInfo()) {
                 return;
             }
-            // ignore POST to token endpoint
-            if ('/_oauth/token' === $request->getPathInfo()) {
-                return;
-            }
         }
 
         if ($this->session->has('_form_auth_user')) {
diff --git a/src/Http/TwoFactorHook.php b/src/Http/TwoFactorHook.php
index <HASH>..<HASH> 100644
--- a/src/Http/TwoFactorHook.php
+++ b/src/Http/TwoFactorHook.php
@@ -41,7 +41,6 @@ class TwoFactorHook implements BeforeHookInterface
             '/_form/auth/logout',
             '/_two_factor/auth/verify/totp',
             '/_two_factor/auth/verify/yubi',
-            '/_oauth/token',
         ];
 
         if (in_array($request->getPathInfo(), $allowedUris, true) && 'POST' === $request->getRequestMethod()) {
oauth token path is obsolete, remove it from ignored URLs