Skip to content
Critical OAuth Bypass Vulnerability in Mage OSS Disclosed

Critical OAuth Bypass Vulnerability in Mage OSS Disclosed

First seen 17 Oct 2026, 19:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 20:48 UTC
  • •CVE-2026-111823 is a critical OAuth bypass with a CVSS score of 9.8.
  • •The vulnerability allows unauthenticated session creation via unknown OAuth providers.
  • •A proof-of-concept has been released, but no active exploitation is confirmed.

Mage OSS has a critical authentication bypass vulnerability (CVE-2026-111823) with a CVSS score of 9.8, allowing unauthenticated access to sessions when an unknown OAuth provider is accepted. The flaw arises from improper error handling in the OAuth callback handler, which fails to terminate session creation despite encountering an error. This vulnerability affects all versions up to 0.9.80 and poses significant risks, especially as Mage OSS manages sensitive credentials for various services. Although a proof-of-concept (PoC) has been released, there is currently no confirmed exploitation in the wild. Organizations are advised to treat this vulnerability as high-risk and implement immediate mitigations. This incident marks a troubling trend of trust-through-defaults failures in recent weeks, indicating broader issues in secure defaults across software stacks. The situation is evolving, and further verification regarding active exploitation is needed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-16
CVE-2026-111823 published
Mage OSS disclosed a critical OAuth bypass vulnerability affecting versions through 0.9.80.
Forkast.News
2026-10-17
First public PoC released
A proof-of-concept for the OAuth bypass vulnerability was made public, detailing the exploit method.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-111823 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

Which versions of Mage OSS are affected?
All versions of Mage OSS up to and including 0.9.80 are affected by this vulnerability.
Is there any confirmed exploitation of this vulnerability?
Currently, there is no confirmed exploitation in the wild, but organizations should remain vigilant.
What should organizations do to mitigate this risk?
Organizations should restrict network access to Mage OSS and monitor for unknown OAuth provider values in session requests.