Rill EUVD-2026-96992

Exploitation requires that the Rill admin OAuth server has dynamic (open) client registration enabled - the default behavior in affected versions 0.77.0 through 0.90.5 - allowing an attacker to self-register a client requesting the long_lived_access_token scope. The critical limiting factor is mandatory victim interaction: an authenticated Rill user must open and approve the attacker-supplied authorization link, so the attack is phishing/social-engineering dependent and cannot be executed silently against the server alone. Impact is scoped to the lured user's permission level; an attacker who lures a high-privilege user obtains correspondingly broad, non-expiring access.

This is a credible, above-average priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H) scores 8.6 and is internally consistent with the description: a remote, unauthenticated attacker exploits the flaw over the network with low complexity, but exploitation is gated by passive user interaction (the victim must open and approve an authorization link). PR:N is justified because the attacker needs no prior credentials - they self-register an OAuth client via open dynamic client registration. No EPSS score, CISA KEV listing, or vendor-declared active-exploitation signal is present in the input, so there is no evidence of in-the-wild use; the probability signals are simply absent, not low. A detailed public technical write-up (hackmd) and direct source-line references to the vulnerable handlers exist, which materially lowers the bar for an attacker to reproduce the issue even though no packaged exploit tool is confirmed. The one real limiting factor is the user-interaction/consent-lure requirement, which makes this phishing-dependent and therefore better suited to targeted than fully automated mass exploitation. Net: a genuine authorization-bypass flaw with high confidentiality and integrity impact, worth prioritizing for any exposed Rill admin deployment, but its practical reach depends on successfully luring an authenticated Rill user.

An attacker uses Rill's open dynamic client registration to register an OAuth client requesting the long_lived_access_token scope, then sends a victim Rill user a crafted authorization link (e.g., via phishing). When the user opens the link, the admin OAuth server issues an authorization code without a genuine consent step, which the attacker exchanges for a non-expiring API token carrying the victim's full permissions. A public technical write-up describing the flaw exists, though no packaged exploit tool is confirmed in the provided data.