Description
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Rill Data rill
Default version status: unaffected
0.77.0 to ≤ 0.90.5affected
pkg:github/rilldata/rillReferences
- https://hackmd.io/@haind03/rill-oauth-open-registration-long-lived-token ↗
- https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/handlers.go#L650-L697 ↗
- https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/mcp_oauth.go#L77-L153 ↗
- https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/pkce.go#L173-L214 ↗
- https://github.com/rilldata/rill ↗
- https://www.vulncheck.com/advisories/rill-0.77.0-through-0.90.5-oauth-missing-authorization-via-dynamic-client-registration ↗