Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108718Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

High 8.1

In plain English

A high-severity missing authorization in rill from Rill Data. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 80.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.

Affected products (as reported)

Vendor	Product	Versions
Rill Data	rill	0.77.0 – through 0.90.5

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://hackmd.io/@haind03/rill-oauth-open-registration-long-lived-token third-party-advisory
https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/handlers.go#L650-L697 technical-description
https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/mcp_oauth.go#L77-L153 technical-description
https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/pkce.go#L173-L214 technical-description
https://github.com/rilldata/rill product
VulnCheck Advisory: Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration third-party-advisory