CVE-2026-111823
Received Received - Intake

Session Creation Bypass in Mage OSS

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: MITRE

Description
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111823

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mage mage-ai 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-390 The product detects a specific error, but takes no actions to handle the error.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Mage OSS allows session creation even when an unknown OAuth provider is used. Normally, OAuth providers must be verified, but this flaw lets attackers bypass authentication by submitting unverified OAuth tokens or manipulating provider identities, potentially creating unauthorized accounts.

Detection Guidance

Check Mage AI logs for unusual session creation events or OAuth provider errors. Review SessionResource.py for improper validation logic. Monitor for unauthorized account creation or unexpected Git command execution in version control APIs.

Impact Analysis

An attacker could exploit this to create unauthorized accounts, gain access to sensitive data, or execute commands through version control APIs. This could lead to data breaches, unauthorized system access, or further compromise of the Mage AI platform.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data or HIPAA by allowing unauthorized access to protected health information. Compliance requires strict access controls, which this flaw undermines by permitting unauthorized account creation and data exposure.

Mitigation Strategies

Update Mage AI to the latest version containing PR #6204 and #6205. Disable OAuth session creation for unverified providers. Restrict Git command execution permissions and enforce role-based access controls for version control APIs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart