CVE-2026-59243
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In FAB auth manager, `verify_signature=False` is the default when decoding ID tokens in Azure AD OAuth login. An attacker can present a forged token (e.g., with 'alg:none') and log in as any user, including Admin.
Risk Assessment
The organization is at risk of complete authentication bypass and admin account takeover, potentially leading to full system compromise.
Recommendation
Upgrade `apache-airflow-providers-fab` to version 3.7.3, which defaults `verify_signature=True`.
Original NVD description (English source)
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.