Rill
Monthly
Unauthenticated attackers can obtain a non-expiring API token carrying a victim's full Rill permissions by abusing open dynamic client registration in the admin OAuth server of Rill Data's Rill 0.77.0 through 0.90.5 (CWE-862, missing authorization). The attacker self-registers an OAuth client with the long_lived_access_token scope and must then convince a logged-in Rill user - typically through a phishing authorization link - to approve it, because exploitation requires user interaction and cannot be executed silently against the server alone; the resulting access is bounded by the lured user's privilege level, so a high-privilege victim yields correspondingly broad, non-expiring access. Rill is not listed in CISA KEV and no public exploit has been identified at time of analysis, although a public technical writeup of the technique is linked from the advisory; the CVSS 4.0 base score is 8.6, and the independent assessment rates this a credible, above-average priority issue rather than an inflated high-CVSS score.
Unauthenticated attackers can obtain a non-expiring API token carrying a victim's full Rill permissions by abusing open dynamic client registration in the admin OAuth server of Rill Data's Rill 0.77.0 through 0.90.5 (CWE-862, missing authorization). The attacker self-registers an OAuth client with the long_lived_access_token scope and must then convince a logged-in Rill user - typically through a phishing authorization link - to approve it, because exploitation requires user interaction and cannot be executed silently against the server alone; the resulting access is bounded by the lured user's privilege level, so a high-privilege victim yields correspondingly broad, non-expiring access. Rill is not listed in CISA KEV and no public exploit has been identified at time of analysis, although a public technical writeup of the technique is linked from the advisory; the CVSS 4.0 base score is 8.6, and the independent assessment rates this a credible, above-average priority issue rather than an inflated high-CVSS score.