Rill: Missing authorization in OAuth dynamic client registration

Summary

Rill versions 0.77.0 through 0.90.5 issue OAuth authorization codes to dynamically registered clients without user consent. An attacker can register a client with the long_lived_access_token scope and lure a logged-in user to an authorization link. The attacker then obtains a non-expiring API token with the user's full permissions. User interaction is required, but no prior privileges are needed.

Affected

• Rill 0.77.0 through 0.90.5 according to the CVE record (VulnCheck)
• VulDB lists only 0.90.0 through 0.90.5; the affected range is unclear
• Whether self-hosted installations expose the admin OAuth server is unknown

Fixed in

Unknown. No vendor advisory or confirmed fixed version found.

• Candidate v0.90.6 on the GitHub releases page is not linked to this CVE and is unverified

Workaround

• No vendor-confirmed workaround found
• Restrict access to the admin OAuth endpoints, for example with network allowlists or a reverse proxy, until a fix is confirmed

Exploitation

• Not marked as known exploited (KEV)
• VulDB reports no available exploit
• A third-party write-up exists; its PoC status is unverified

Our recommendation

• Inventory whether Rill is in use and which version runs
• Check whether the admin OAuth endpoints are reachable from the internet, and prioritise Rill Cloud or internet-facing admin services
• Review OAuth clients and API tokens for unknown entries and revoke them
• Tell users not to approve unexpected authorization requests and reinforce phishing awareness
• Upgrade only after the vendor confirms a fixed version

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Rill repository github.com
• Rill releases github.com
• VulDB entry vuldb.com
• Third-party write-up hackmd.io
• Code reference handlers.go github.com
• Code reference mcp_oauth.go github.com
• Code reference pkce.go github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:53.