diff --git a/fastapi/dependencies/utils.py b/fastapi/dependencies/utils.py
index 3df5ccfc8..bebbbe954 100644
--- a/fastapi/dependencies/utils.py
+++ b/fastapi/dependencies/utils.py
@@ -147,7 +147,7 @@ def get_sub_dependant(
     security_scopes = security_scopes or []
     if isinstance(depends, params.Security):
         dependency_scopes = depends.scopes
-        security_scopes.extend(dependency_scopes)
+        security_scopes = security_scopes + list(dependency_scopes)
     if isinstance(dependency, SecurityBase):
         use_scopes: List[str] = []
         if isinstance(dependency, (OAuth2, OpenIdConnect)):
diff --git a/tests/test_dependency_scopes.py b/tests/test_dependency_scopes.py
index 0d07cd305..957a0896e 100644
--- a/tests/test_dependency_scopes.py
+++ b/tests/test_dependency_scopes.py
@@ -47,7 +47,6 @@ def recursive_scopes(dep=Security(dep3, scopes=["scope3"])):
 client = TestClient(app)
 
 
-@pytest.mark.xfail()
 # issue https://github.com/tiangolo/fastapi/issues/5623
 def test_recursive_scopes(mocks):
     """