Mage AI PR #6204: reject failed OAuth identity resolution

Evidence record

Maintainer patch and regression tests for unrecognized OAuth provider falling through to self-asserted email and session creation; source merge not proof of shipped package.

Read the original source ↗

Claim-level citations (3)

• supportsMage AI OAuth session issuing fell back to user-supplied identity: The insecure branch performed session issuance using a request-supplied email after unsupported OAuth provider resolution failed, enabling impersonation in the reproduced setup.

  PR #6204 problem statement, before-fix regression cases

• supportsMage AI OAuth session issuing fell back to user-supplied identity: The source patch requires recognized OAuth provider and verified identity before user lookup/session issuance, and includes passing regression tests.

  PR #6204 changed authentication branch and test results

• supportsMage AI OAuth session issuing fell back to user-supplied identity: Mage maintainers merged the OAuth identity validation fix as PR #6204 on October 16, 2026; source merge is not proof that every released Mage container image was updated.

  Pull request #6204 merge status, provider verification checks and tested regressions