CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243

creationtimestamp| type| source ---|---|--- 2026-07-28 11:02:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpb5kx43v2d 2026-07-29 16:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrseoxjskc2i 2026-08-04 22:00:04+00:00| published-proof-of-concept|...