CVE-2026-108718: Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Q: Who is exposed to this issue?

Users who can be lured into visiting an attacker-controlled OAuth authorization link are exposed. The attacker can obtain a non-expiring API token carrying the permissions of the user who follows the link.

Q: What does an attacker need to exploit it?

The attacker needs network access and does not need prior privileges. They can dynamically register an OAuth client, request the long_lived_access_token scope, and persuade a user to open the authorization link.

Q: Does exploitation require the user to approve a consent prompt?

No. The vulnerable admin OAuth server issues authorization codes to dynamically registered clients without user consent.

Q: What is the impact if exploitation succeeds?

The attacker obtains a non-expiring API token with the affected user's full permissions. Confidentiality and integrity are both affected; availability impact is not indicated.

Published Oct 11, 2026

Updated

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.

Affected Software

1 affected component

Rill Rill>=0.77.0<=0.90.5

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Event

via NVD·02:46 PM

Frequently Asked Questions

Who is exposed to this issue?

Users who can be lured into visiting an attacker-controlled OAuth authorization link are exposed. The attacker can obtain a non-expiring API token carrying the permissions of the user who follows the link.

What does an attacker need to exploit it?

The attacker needs network access and does not need prior privileges. They can dynamically register an OAuth client, request the long_lived_access_token scope, and persuade a user to open the authorization link.

Does exploitation require the user to approve a consent prompt?

No. The vulnerable admin OAuth server issues authorization codes to dynamically registered clients without user consent.

What is the impact if exploitation succeeds?

The attacker obtains a non-expiring API token with the affected user's full permissions. Confidentiality and integrity are both affected; availability impact is not indicated.

CVE-2026-108718: Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does exploitation require the user to approve a consent prompt?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does exploitation require the user to approve a consent prompt?

What is the impact if exploitation succeeds?