Mage OSS prior to commit 76c4f46 creates a user session when it receives a request from an unknown OAuth provider. The absence of a verification step allows an attacker to supply a fabricated provider and obtain an authenticated session without possessing valid credentials. This flaw enables an unauthenticated attacker to impersonate legitimate users or access resources that require authenticated sessions, potentially leading to unauthorized data disclosure or privilege escalation. The weakness belongs to CWE-390, which describes unchecked or unexpected failures in a program’s logic that can be exploited for unauthorized actions.

The vulnerability is present in the Mage:mage-ai product for all releases up to and including 0.9.80 that have not incorporated the merged PRs from 2026-10-16. The patches that introduce rejection of unverified OAuth identities and strengthen command execution semantics are available only in the source repository; no released binary or container image currently contains them.

The CVSS score of 9.8 classifies the flaw as critical. While EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the high severity and the ability to trigger an authentication bypass remotely via the OAuth endpoint suggest that a determined attacker could exploit the flaw by registering a malicious OAuth provider or manipulating an existing one. If successful, the attacker would obtain authorized access to the Mage service with the privileges of the user constructed by the application.