Mage AI OAuth session issuing fell back to user-supplied identity

Mage AI's affected session flow promoted a claim supplied by the client into account identity. A request could specify an unsupported OAuth provider, fail to produce a verified provider identity and nonetheless continue to local user lookup or account creation using the request's email address. That made session issuance possible without the external verification that the OAuth path was supposed to require.

The maintainer's PR #6204 changes the ordering: reject unknown providers, failed verification and missing validated identity before looking up or creating a user. Regression tests reproduced impersonation and new-account creation before the patch and rejection afterward. The source change was merged on October 16, 2026; the available evidence does not establish which published image or package tag first included it. Affected users need version-specific deployment evidence rather than an assumption that any repository merge upgrades a running service.

A forged session may lead to further consequences through file, Git or terminal features, depending on the resulting account's permissions. Those are not all part of the OAuth bug itself. Mage's separate shell-construction, repository-role and terminal-output findings each retain distinct prerequisites and remediation states. This authentication failure is conventional server-side code inside an AI-capable development platform; the research does not establish that an autonomous model caused or exploited it.