[ |
| **Affected** | Through **0.9.80** (PyPI may still ship vulnerable builds; verify commit / patch) |
| **Fixed** | **76c4f46** / PR [#6204]( |
| **CVSS 3.1** | **9.8** (Critical, MITRE) |
When `token` and `provider` are present, vulnerable `SessionResource.create()` resolves the provider. If the name is **unknown**, the code path still performs user lookup / creation using the **request body `email`**, without validating OAuth — then returns a normal session JWT.
Exploit body (same as upstream regression tests):
Requires **`X-API-KEY`** (public OAuth client key from the Mage UI / docs). Instance must have **`require_user_authentication=true`** (default on OSS **0.9.78+**).
├── poc.py # CLI: check / exploit (default: exploit)
├── mage_core.py # Fingerprint, OAuth probe, session verify
├── targets.example.txt # Bulk target list template
└── .github/workflows/ # CI unit tests
git clone
Fingerprint via `GET /api/status`, optional OAuth probe:
python poc.py --mode check -b
# Active probe (issues bypass request; may create a user if vulnerable)
python poc.py --mode check -b --oauth-probe
python poc.py -f targets.txt --mode check --oauth-probe -o results.jsonl
python poc.py -b -e [email protected] --save-token session.json
| `--api-key KEY` | Override `X-API-KEY` (default: scrape HTML or docs example) |
| `--skip-version-check` | Attempt even if version hint looks patched |
| `--force` | Try bypass when `require_user_authentication=false` |
| `--save-token PATH` | Save `api_key` + JWT for manual API use |
On success the tool confirms API access (e.g. `GET /api/pipelines` or `/api/users`).
python -m unittest discover -s tests -t . -v
- Deploy Mage built from source **including PR #6204** (reject unknown OAuth before session creation).
- Until upgraded: restrict network access to Mage (6789), enforce SSO only with verified providers, monitor `POST /api/sessions` for unknown `provider` values.
The original report describes post-auth exposure (version control, file explorer, terminal). Hardening: PR [#6205]( [#6206]( This PoC demonstrates **session takeover / API access** only.
- [CVE-2026-111823](
- [PR #6204 — Reject unverified OAuth session identities](
- [Mage — Create session](
- [PoCbit page](
This project is for **defensive security research**, patch validation, and **authorized** penetration testing. Misuse is prohibited. Authors assume no liability for unauthorized use.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
