Vulnerability Details CVE-2026-59243
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 41.7%
CVSS Severity
CVSS v3 Score 9.8
References
Products affected by CVE-2026-59243
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.0.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.0.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.0.3
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.0.4
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.1.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.4.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.5.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.5.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.5.3
-
cpe:2.3:a:apache:apache-airflow-providers-fab:1.5.4
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.0.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.0.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.2.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.3.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.4.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.4.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.4.3
-
cpe:2.3:a:apache:apache-airflow-providers-fab:2.4.4
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.0.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.0.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.0.3
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.1.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.1.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.6.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.6.2
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.6.3
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.6.4
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.6.5
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.7.0
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.7.1
-
cpe:2.3:a:apache:apache-airflow-providers-fab:3.7.2