EUVD-2026-96992

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...