AIKIDO-2026-235196

apache-airflow-providers-fab is vulnerable to Authentication Bypass

Authentication BypassCVE-2026-59243 Published 3 days ago

Critical Risk

This Affects:

apache-airflow-providers-fab

0.0.1 - 3.7.2

Fixed in 3.7.3

Are you affected? Scan for Free

TL;DR

The FAB auth manager's Azure AD OAuth login decodes the incoming id_token with signature verification turned off by default. Because verify_signature defaults to a value that skips validation, a forged or unsigned (alg:none) token presented to the OAuth callback is accepted as authentic. Anyone able to reach that callback can log in as an arbitrary user, including an account holding the Admin role. The fix flips the default so the Azure AD id_token signature is verified, matching the Authentik login path.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the FAB auth manager with the Azure AD OAuth login path enabled. In that configuration signature verification is skipped by default, so an untrusted id_token submitted to the OAuth callback is accepted without validation. Deployments that do not enable the Azure AD OAuth login path are not exposed.