External risk intelligence

Mage OSS Session Creation Vulnerability with Unknown OAuth Providers

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-111823

Mage OSS is a data pipeline platform that provides web-based user interfaces and API endpoints for orchestration. These components are frequently deployed as internet-facing or externally accessible services to facilitate remote access for data teams and integration with external cloud services, making the session creation and OAuth authentication surface commonly reachable via the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Mage OSS that could allow unauthorized session creation when encountering unrecognized authentication providers. The core issue is a flaw in how the system handles unknown OAuth providers, potentially leading to security weaknesses if not properly managed. The primary concern for leadership is to confirm if this technology is in use within the organization and assess any potential exposure.

Sessions created incorrectly with unknown providers.
Confirm usage and potential exposure of Mage OSS.
Assess operational relevance and security posture.

Attack Path

How an attacker could exploit the issue

An attacker can initiate a session creation process by interacting with the Mage OSS platform's online interface or API. The vulnerability lies in how the system handles unknown OAuth providers, allowing it to proceed even when an unrecognized one is provided. Successful exploitation could grant unauthorized access to the system, leading to sensitive data exposure, unauthorized modifications, or service disruption.

Entry: Open network access to Mage OSS.
Trigger: Unknown OAuth provider during session creation.
Risk: Full system compromise, data theft, or disruption.

Live Threat

Current exploitation, exposure, and threat context

When an unknown OAuth provider is encountered, Mage OSS may proceed with session creation. This could potentially impact system data and service behavior.

System data and service behavior at risk.
Session creation with unknown providers.
Unauthorized access and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Mage OSS impacts session creation when encountering unknown OAuth providers, potentially allowing unauthorized access. Identifying where Mage OSS is deployed, confirming its reachability and business criticality, and then assigning ownership are the immediate next steps. The primary action involves verifying the exposure of the affected service and coordinating with the platform or application owner for remediation.

Platform or application owners should own this.
Verify external accessibility and criticality.
Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mage OSS?

Mage OSS is an open-source data pipeline platform designed for building, running, and managing data workflows. It provides data teams with web-based user interfaces and API endpoints to orchestrate complex data tasks and integrate with various external cloud services.

How does CVE-2026-111823 affect session creation?

This vulnerability, classified as CWE-390 (Detection of Error Condition Without Action), means the software fails to properly handle unexpected input. Specifically, if a user attempts to authenticate using an unknown OAuth provider, the system erroneously proceeds with session creation instead of rejecting the request, potentially granting unauthorized access.

What triggers this session handling flaw?

An attacker triggers the issue by supplying an unrecognized or unknown OAuth provider during the authentication process. The vulnerability does not occur when using known, pre-configured authentication providers, as the system correctly validates those expected inputs.

Is my Mage OSS instance at risk?

According to Halo Surface Signal, this risk is higher for instances that are internet-facing. Because Mage OSS is often deployed to allow remote access for distributed data teams and cloud integrations, these externally reachable interfaces are the primary targets for exploiting this session creation flaw.

How should I respond to this threat?

Begin by identifying all deployments of Mage OSS within your environment. Once located, verify which instances are accessible via the network, prioritize those exposed to the internet, and coordinate with the specific platform owners to manage the risk and apply necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.