CVE-2026-75156

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience of Azure AD id_tokens during OAuth login. Because signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, a token minted in any Azure tenant—including one an attacker creates—passes sig...