JWT signature verification bypass in Apache Airflow FAB provider (CVE-2026-59243)

The FAB auth manager's Azure AD OAuth login path defaulted `verify_signature=False` when decoding the ID token, allowing an attacker to present a forged or unsigned (`alg:none`) ID token to the OAuth callback and authenticate as an arbitrary user. This bypass extends to accounts holding the Admin role, exposing affected deployments to full administrative compromise under the default configuration. Affected versions: - Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.7.3 We recommend updating to: apache-airflow-providers-fab 3.7.3. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/298 Details: https://vuln.today/cve/CVE-2026-59243