CVE-2026-111823

critical

Description

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

References

https://thecoregroup.net/category/the-core-group/

https://github.com/mage-ai/mage-ai/pull/6205

https://github.com/mage-ai/mage-ai/pull/6204/changes/76c4f467f3654041d8899b1c4447a985710d26c0

https://github.com/mage-ai/mage-ai/pull/6204

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103205

Details

Source: Mitre, NVD

Published: 2026-10-17

Updated: 2026-10-17

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00371