Not rated
CVE-2026-59243 The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an…
Description
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Airflow Fab Provider 3.7 | earliest → < 3.7.3 | 3.7.3 |
References
- github.com github.com
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Airflow Fab Provider
The 9 CVEs of Apache Airflow Fab Provider →
CVE-2026-86466
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience…
Not rated
CVE-2026-82310
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
Not rated
CVE-2026-86462
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate…
Not rated
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed…
Not rated