CVE-2026-108718 in Rill
Summary
by MITRE • 10/11/2026
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Rill versions 0.77.0 through 0.90.5 represents a critical failure in access control mechanisms within the administrative OAuth server component. This flaw specifically affects the process of issuing authorization codes to dynamically registered clients, bypassing the mandatory user consent step that is fundamental to secure OpenID Connect and OAuth2 implementations. In standard security architectures, when an application requests access to a user's resources via an identity provider, the system must explicitly verify that the resource owner has granted permission for that specific scope of access. The absence of this verification mechanism allows any entity capable of registering as a client on the platform to initiate an authorization flow without obtaining explicit approval from the end-user. This deviation from established security protocols creates a direct path for unauthorized data access and privilege escalation, undermining the integrity of the authentication framework.
From a technical perspective, the core issue lies in how the server handles dynamic client registration combined with specific high-privilege scopes. An attacker can register a malicious application as a legitimate client within the system's configuration interface. By selecting or requesting the long_lived_access_token scope during this registration process, the attacker configures their client to receive tokens that do not expire under normal circumstances. When an unsuspecting user is tricked into visiting a specially crafted authorization link hosted by or associated with this malicious client, the server issues an authorization code without prompting for consent. This code can then be exchanged for an access token that carries the full permissions of the compromised user account. Because these tokens are configured to have long lifespans, they remain valid indefinitely unless manually revoked, providing persistent and undetected access to sensitive systems and data associated with the victim's identity.
The operational impact of this vulnerability is severe, enabling complete account takeover scenarios for any authenticated user within the Rill ecosystem. Once an attacker obtains a non-expiring API token with full permissions, they can act as the legitimate user without needing further interaction or credentials such as passwords or multi-factor authentication codes. This capability allows for extensive data exfiltration, modification of critical configurations, and potential lateral movement into other connected systems if those integrations rely on the same identity provider. The persistence of these tokens means that even if a user changes their password after compromise, the attacker retains access until they discover and revoke the malicious token or an administrator intervenes. This significantly increases the window of exposure and complicates incident response efforts, as standard credential rotation procedures are insufficient to remediate the breach.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding failures in verifying user consent during OAuth flows. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where adversaries exploit legitimate credentials or tokens to maintain access and perform actions as an authorized entity. The specific mechanism of abusing dynamic client registration without consent is a classic example of authorization bypass that undermines the trust model of federated identity systems. Organizations relying on Rill for data analytics or management must treat this as a high-severity issue requiring immediate attention due to its potential for widespread compromise and long-term persistence within affected environments.
To mitigate this vulnerability, administrators should immediately upgrade to a patched version of Rill that addresses the missing authorization check in the admin OAuth server. If upgrading is not immediately feasible, it is critical to disable dynamic client registration entirely or restrict it to pre-approved, static clients with strict scope limitations. Administrators should also audit existing registered clients and revoke any tokens associated with scopes such as long_lived_access_token unless absolutely necessary for specific, trusted integrations. Implementing stricter validation rules that enforce user consent prompts before issuing authorization codes is essential to restoring the security posture of the OAuth implementation. Additionally, enabling token expiration policies by default can limit the window of opportunity for attackers who manage to exploit this flaw in unpatched environments. Regular monitoring of authentication logs for unusual patterns, such as new client registrations followed immediately by high-privilege token requests, can aid in early detection and response to potential exploitation attempts.