The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (…

CVE-2026-59243 affects apache-airflow-providers-fab before version 3.7.3, where the FAB auth manager's Azure AD OAuth login path defaulted to verify_signature=False when decoding JWT ID tokens. This misconfiguration allowed attackers to present forged or unsigned tokens using the alg:none algorithm to the OAuth callback endpoint, bypassing authentication entirely. An attacker could exploit this to log in as any arbitrary user, including those with Admin roles. Only deployments using the Azure AD OAuth login path under its default configuration are affected; the Authentik path was already secure. The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature). Users are strongly advised to upgrade to apache-airflow-providers-fab 3.7.3, which fixes the issue by defaulting verify_signature to True.