{"schema":"threatline.record/2","record":{"id":"CVE-2026-108718","aliases":[],"summary":"Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration","details":"Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.","categories":["Unclassified"],"product":"rill","vendor":"Rill Data","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108718","source_modified_at":"2026-10-18T11:53:06.974Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"rill","vendor":"Rill Data","versions":[{"version":"0.77.0","lessThanOrEqual":"0.90.5","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.6,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00271,"percentile":0.18334,"score_date":"2026-10-23"},"published_at":"2026-10-11T12:19:30.004Z","modified_at":"2026-10-18T11:53:06.974Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108718","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-18T11:53:06.974Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108718","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind03/rill-oauth-open-registration-long-lived-token","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/handlers.go#L650-L697","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/mcp_oauth.go#L77-L153","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/pkce.go#L173-L214","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/rilldata/rill","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/rill-0.77.0-through-0.90.5-oauth-missing-authorization-via-dynamic-client-registration","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-18T11:30:40.690580Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-18T11:53:06.974Z","content_hash":"4b4d98e1b714b00437988b3430419b8c813a2baa061da8eab6fb2240a8c4cda7"}}