Critical severity · published Oct 16, 2026
CVE-2026-111823
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mage-ai · Mage
through 0.9.80 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111823
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111823
github.com
https://github.com/mage-ai/mage-ai/pull/6204
github.com
https://github.com/mage-ai/mage-ai/pull/6204/changes/76c4f467f3654041d8899b1c4447a985710d26c0
github.com
https://github.com/mage-ai/mage-ai/pull/6205
thecoregroup.net
https://thecoregroup.net/category/the-core-group/
More from mage-ai
9.8
CVE-2023-31143
Mage terminal user authentication not working properly
8.8
CVE-2024-45187
Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution
6.5
CVE-2024-45190
Mage AI pipeline interaction request remote arbitrary file leak
6.5
CVE-2024-45189
Mage AI git content request remote arbitrary file leak
6.5
CVE-2024-45188
Mage AI file content request remote arbitrary file leak