Mage OSS has a patch with no release for CVE-2026-111823
The critical flaw lets anyone create sessions without authenticating in versions through 0.9.80; the fix is in the code, but not in a published release.
Mage OSS (mage-ai), an open-source tool for building data pipelines, merged pull request #6204, "Reject unverified OAuth session identities", into its GitHub repository on October 16. It fixes a critical vulnerability that was published a day later as CVE-2026-111823, according to The Hacker Wire, an aggregator that reproduces the record.
OAuth is the mechanism that lets people sign in with an account from another service. The description says that, faced with an OAuth provider it did not recognize, the server went ahead and created the session instead of denying access, so a session could be opened without authenticating. The flaw was reported privately.
| Item | Detail |
|---|---|
| CVE | CVE-2026-111823 |
| Product | Mage OSS |
| Affected versions | 0.9.80 and earlier (code before commit 76c4f46) |
| Patch | Pull request #6204, merged October 16; no published release includes it |
The CVSS 3.1 score is 9.8, critical: it is exploitable over the network, with no privileges and no user action. The fix makes session creation fail safely. The server now cuts off the request before looking up the user or issuing a session in four cases: unknown provider, incomplete credentials, a provider failure, or a response with no identity.
GitHub's releases page lists 0.9.80 as the latest, which falls inside the affected range. Pull request #6204 does not say which version will carry the fix. This article does not describe how to exploit it.
According to The Hacker Wire, the vulnerability is not in the catalog of exploited flaws kept by CISA, the US cybersecurity agency, and its 30-day exploitation probability (EPSS) is 0.37%. It also found no public proof of concept, which does not prove none exists.
Three things remain to be confirmed: the version that will carry the patch, which the project's release notes will show; the NVD record, the official US catalog, which could not be read, so the score and versions come from the aggregator; and a related pull request, #6205, that was not reviewed.
