CVE-2026-108718
Description
A flaw was found in Rill. The administrative Open Authorization (OAuth) server issues authorization codes to dynamically registered clients without requiring user consent. A remote attacker can exploit this flaw by tricking an authenticated user into opening a malicious authorization link, allowing the attacker to obtain a persistent Application Programming Interface (API) token with the victim's full permissions.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can hijack an authenticated session and acquire perpetual API credentials with full administrative permissions, bounded only by the need for user interaction. Red Hat products do not package or distribute the Rill component, leaving supported enterprise environments unaffected by this flaw.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
