{"vulnerability": "CVE-2026-108718", "sightings": [{"uuid": "8ec5fd40-7d3b-44ef-a2b3-a1356c7792bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108718", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422329605993498", "content": "CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108718https://hackmd.io/@haind03/rill-oauth-open-registration-long-lived-tokenhttps://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/handlers.go#L650-L697https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/mcp_oauth.go#L77-L153https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/pkce.go#L173-L214https://github.com/rilldata/rillhttps://www.vulncheck.com/advisories/rill-0.77.0-through-0.90.5-oauth-missing-authorization-via-dynamic-client-registration#RillData #rill#CVE_2026_108718#bot", "creation_timestamp": "2026-10-11T12:42:40.374096Z"}, {"uuid": "4247a40d-1337-405b-9c62-3f10f019310f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108718", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hjbc5gjdxvu7u", "content": "CVE-2026-108718 - Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration\nCVE ID : CVE-2026-108718\n \n Published : Oct. 11, 2026, 1:17 p.m. | 13\u00a0minutes ago\n \n Description : Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability...", "creation_timestamp": "2026-10-11T13:56:10.474012Z"}]}