Mage OSS CVE-2026-111823: OAuth Validation Gap in v0.9.80 Triggers 9.8 Critical Auth Bypass

Mage OSS through version 0.9.80 contains a critical authentication bypass vulnerability that permits session creation when the system encounters an unknown OAuth provider. This defect allows the application to proceed with initializing user sessions without verifying the identity or trustworthiness of the OAuth source. The issue stems from the software's behavior as documented in the National Vulnerability Database entry CVE-2026-111823.

Root cause

The underlying weakness is classified as CWE-390. According to the NVD record, the software logic proceeds with session creation upon encountering an unknown OAuth provider. This behavior indicates a failure to handle the condition of an unrecognized provider appropriately. The design allows the session initialization process to continue regardless of whether the OAuth provider is known or trusted by the system.

Attack path

The vulnerability allows the application to proceed with session creation upon encountering an unknown OAuth provider. This behavior effectively bypasses standard authentication controls by establishing a session state that was not intended to be created by unverified sources. The flaw exists in versions of Mage OSS through 0.9.80 before commit 76c4f46.

Affected versions

• Mage OSS version 0.9.80 and all prior releases are vulnerable.
• The specific commit 76c4f46 marks the point where this behavior was addressed.
• Environments running any version of mage-ai up to 0.9.80 are exposed to this session creation bypass.

Mitigation

• Upgrade Mage OSS to a version newer than 0.9.80, specifically post-commit 76c4f46.
• Review authentication logs for sessions initiated by unrecognized OAuth providers.
• Implement additional validation layers for OAuth provider identities if immediate patching is not possible.

Detection notes

Security operations teams should monitor authentication logs for session creation events originating from OAuth providers not listed in the organization's trusted identity sources. Alerts should trigger when the application records successful session initialization following an authentication request from an unknown or unverified provider. Analysts must check whether these sessions were granted access to protected resources or features. Immediate containment involves terminating active sessions that originated from unverified OAuth sources and reviewing access logs for anomalous user activity patterns associated with these newly created sessions.

What to do and how to stay safe: Mage OSS

• Inventory all Mage OSS instances and verify current version numbers against the affected range.
• Enable detailed logging for OAuth authentication events to capture provider identifiers.
• Configure alerts for authentication attempts from providers not in your pre-approved list.
• Prepare an incident response plan for unauthorized session creation events.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-111823?

CVE-2026-111823 is a critical vulnerability in Mage OSS through 0.9.80 that allows session creation with unknown OAuth providers.

How severe is this vulnerability?

The NVD rates this vulnerability as CVSS 9.8 critical, indicating a high level of severity.

Which versions of Mage OSS are affected?

All versions of Mage OSS up to and including 0.9.80 are affected by this flaw.