Mage OSS Ships an OAuth Bypass That Creates Sessions from Unrecognized Providers — the Tenth Trust-Through-Defaults Incident in Twenty-One Days

Mage OSS, a data pipeline orchestration tool, contains a critical authentication bypass vulnerability tracked as CVE-2026-111823 . The flaw, identified in GHSA-93gm-r5p2-wxq7 , carries a CVSS score of 9.8. It affects all versions of the platform through 0.9.80. The vulnerability stems from a failure in the OAuth callback handler, which incorrectly manages error states during the authentication handshake. When the system encounters an unknown provider, it triggers an error condition but proceeds to initialize a session regardless, effectively granting authenticated access without valid credentials. The technical failure is categorized under CWE-390: Detection of Error Condition Without Action . In practice, the Mage OAuth callback logic fails to terminate the request flow when an error is detected. Instead, the error handler inadvertently completes the session creation process.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.