diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java
index 67bf580518..e5c245624d 100644
--- a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java
@@ -34,6 +34,7 @@ import org.keycloak.models.RealmModel;
 import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderFactory;
 import org.keycloak.representations.dpop.DPoP;
+import org.keycloak.services.cors.Cors;
 
 /**
  * Provider interface for OAuth 2.0 grant types
@@ -85,14 +86,14 @@ public interface OAuth2GrantType extends Provider, ProviderFactory<OAuth2GrantTy
         protected HttpHeaders headers;
         protected MultivaluedMap<String, String> formParams;
         protected EventBuilder event;
-        protected Object cors;
+        protected Cors cors;
         protected Object tokenManager;
         protected DPoP dPoP;
 
         public Context(KeycloakSession session, RealmModel realm,
                 ClientModel client, Object clientConfig, ClientConnection clientConnection, Map<String, String> clientAuthAttributes,
                 HttpRequest request, HttpResponse response, HttpHeaders headers, MultivaluedMap<String, String> formParams,
-                EventBuilder event, Object cors, Object tokenManager, DPoP dPoP) {
+                EventBuilder event, Cors cors, Object tokenManager, DPoP dPoP) {
             this.session = session;
             this.realm = realm;
             this.client = client;
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
index ba8bcfd731..4abbed801c 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
@@ -45,34 +45,7 @@ import org.keycloak.saml.common.exceptions.ConfigurationException;
 import org.keycloak.saml.common.exceptions.ProcessingException;
 import org.keycloak.saml.common.util.DocumentUtil;
 import org.keycloak.services.CorsErrorResponseException;
-import org.keycloak.services.ServicesLogger;
-import org.keycloak.services.Urls;
-import org.keycloak.services.clientpolicy.ClientPolicyContext;
-import org.keycloak.services.clientpolicy.ClientPolicyException;
-import org.keycloak.services.clientpolicy.context.ResourceOwnerPasswordCredentialsContext;
-import org.keycloak.services.clientpolicy.context.ResourceOwnerPasswordCredentialsResponseContext;
-import org.keycloak.services.clientpolicy.context.ServiceAccountTokenRequestContext;
-import org.keycloak.services.clientpolicy.context.ServiceAccountTokenResponseContext;
-import org.keycloak.services.clientpolicy.context.TokenRefreshContext;
-import org.keycloak.services.clientpolicy.context.TokenRefreshResponseContext;
-import org.keycloak.services.clientpolicy.context.TokenRequestContext;
-import org.keycloak.services.clientpolicy.context.TokenResponseContext;
 import org.keycloak.services.cors.Cors;
-import org.keycloak.services.managers.AppAuthManager;
-import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.services.managers.AuthenticationSessionManager;
-import org.keycloak.services.managers.ClientManager;
-import org.keycloak.services.managers.RealmManager;
-import org.keycloak.services.managers.UserSessionManager;
-import org.keycloak.services.resources.Cors;
-import org.keycloak.services.util.AuthorizationContextUtil;
-import org.keycloak.services.util.DefaultClientSessionContext;
-import org.keycloak.services.util.DPoPUtil;
-import org.keycloak.services.util.MtlsHoKTokenUtil;
-import org.keycloak.sessions.AuthenticationSessionModel;
-import org.keycloak.sessions.RootAuthenticationSessionModel;
-import org.keycloak.util.TokenUtil;
-import org.keycloak.utils.ProfileHelper;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java
index 684a2efc05..bffe72d2e7 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java
@@ -58,7 +58,7 @@ import org.keycloak.services.CorsErrorResponseException;
 import org.keycloak.services.ServicesLogger;
 import org.keycloak.services.clientpolicy.ClientPolicyContext;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
-import org.keycloak.services.resources.Cors;
+import org.keycloak.services.cors.Cors;
 import org.keycloak.services.util.AuthorizationContextUtil;
 import org.keycloak.services.util.DPoPUtil;
 import org.keycloak.services.util.MtlsHoKTokenUtil;
@@ -104,7 +104,7 @@ public abstract class OAuth2GrantTypeBase implements OAuth2GrantType {
         this.headers = context.headers;
         this.formParams = context.formParams;
         this.event = context.event;
-        this.cors = (Cors) context.cors;
+        this.cors = context.cors;
         this.tokenManager = (TokenManager) context.tokenManager;
         this.dPoP = context.dPoP;
     }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java
index 422e273c61..61bca8ad30 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java
@@ -95,6 +95,7 @@ public class ResourceOwnerPasswordCredentialsGrantType extends OAuth2GrantTypeBa
         AuthenticationProcessor processor = new AuthenticationProcessor();
         processor.setAuthenticationSession(authSession)
                 .setFlowId(flowId)
+                .setFlowPath("token")
                 .setConnection(clientConnection)
                 .setEventBuilder(event)
                 .setRealm(realm)