CVE-2026-111823 Mage CVE debrief

Who should care

Defenders responsible for Mage OSS deployments should assess exposure and verify OAuth provider configurations. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that Mage OSS versions are updated and OAuth provider configurations are secure to prevent unauthorized session creation. Immediate attention is required due to the critical nature of this vulnerability.

Why it matters

Defenders should prioritize verifying Mage OSS versions and OAuth provider configurations to prevent unauthorized session creation.

• Verify Mage OSS version and OAuth provider configurations to prevent unauthorized session creation
• Monitor for unusual session creation activity to detect potential exploitation
• Update Mage OSS to 76c4f46 or later to address the vulnerability

Technical summary

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider, leading to potential unauthorized access. This critical vulnerability, with a CVSS score of 9.8, requires immediate attention. Defenders should prioritize verifying Mage OSS versions and OAuth provider configurations to prevent exploitation. The vulnerability allows for session creation without proper validation of OAuth providers, increasing the risk of unauthorized access to Mage OSS deployments. Updating to version 76c4f46 or later is recommended to address this vulnerability.

Defensive priority

Defenders should prioritize verifying Mage OSS versions and OAuth provider configurations.

Recommended defensive actions

• Verify Mage OSS version and update to 76c4f46 or later
• Review OAuth provider configurations
• Monitor for unusual session creation activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. This vulnerability has a CVSS score of 9.8 and is considered critical. The evidence is based on the official CVE Program record and the NIST NVD detail page. Defenders should verify Mage OSS versions and OAuth provider configurations to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.