---
id: "CVE-2026-111823"
kind: "vulnerability"
aliases: ["CVE-2026-111823"]
title: "Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "mage-ai", "fixed": [], "affected": "<= 0.9.80, before commit 76c4f46", "ecosystem": "pypi"}]
ecosystems: []
tags: ["authentication-bypass", "mage-oss", "oauth", "other", "self-hosted"]
not_affected_if: ["not-internet-exposed", "unknown"]
published_at: "2026-10-17T02:17:18+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T23:28:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111823", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:28:44+00:00"}]
---

# Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider

Mage OSS up to 0.9.80 (the latest release as of 23 Oct 2026) can create a login session from an unverified OAuth provider/token in the session-create API, so an unauthenticated attacker may get a session. The fix is commit 76c4f46 on master, and no release containing it was found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mage-ai affected <= 0.9.80, before commit 76c4f46 fixed ?

## How to check

Run 'pip show mage-ai' (or check the Docker image tag). Version 0.9.80 or older, without commit 76c4f46, is affected. Check whether the Mage UI/API is reachable by untrusted networks. Whether it matters when OAuth is not configured is unconfirmed.

## Fix

No release containing 76c4f46 found yet (latest is 0.9.80). Build from the mage-ai/mage-ai repo at 76c4f467f3654041d8899b1c4447a985710d26c0 or later, or upgrade once a release after 0.9.80 ships. Until then, do not expose Mage to untrusted networks (put it behind a VPN or authenticated proxy).

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111823
- 2026-10-23T23:28:44+00:00 analyst — Read fix commit 76c4f46 (16 Oct 2026, SessionResource.py): login now rejects any token/provider not verified by a known SSO provider. Latest release on the releases page is 0.9.80 (9 Oct), which predates the commit, so no fixed release is published as far as I can see. NVD page returned nothing. The pre-fix code was not read, so whether OAuth must be enabled is unconfirmed. No PoC or exploitation found; X and HN not searched.

## Documents

- [fix] Mage OSS commit 76c4f46: Reject unverified OAuth session identities https://github.com/mage-ai/mage-ai/commit/76c4f467f3654041d8899b1c4447a985710d26c0
- [mentions] Mage OSS releases (latest 0.9.80, 9 Oct) https://github.com/mage-ai/mage-ai/releases

## From the sources

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_