Non notée
CVE-2026-59243 The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an…
Description
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Airflow Fab Provider 3.7 | premières → < 3.7.3 | 3.7.3 |
Références
- github.com github.com
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Airflow Fab Provider
Les 9 CVE de Apache Airflow Fab Provider →
CVE-2026-86466
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience…
Non notée
CVE-2026-82310
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
Non notée
CVE-2026-86462
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate…
Non notée
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed…
Non notée