EUVD-2026-50216
GHSA-q5r3-w69r-hrfw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible endpoint, trivial token forgery (low complexity), no privileges or user interaction required, full compromise of confidentiality, integrity, and availability.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from verify_signature defaulting to False, enabling acceptance of unsigned or algorithm-none tokens.
Technical ContextAI
The vulnerability lies in the FAB auth manager’s OAuth login module for Azure AD within apache-airflow-providers-fab. During ID token decoding, the verify_signature parameter defaulted to False, bypassing JWT signature validation (CWE-347: Improper Verification of Cryptographic Signature). An attacker can craft a token with the alg:none header and arbitrary claims (e.g., user identity, admin role) to impersonate any user. The issue is specific to the Azure AD path; the Authentik OAuth path already enforced verification. The exact affected product is apache-airflow-providers-fab before version 3.7.3.
RemediationAI
Upgrade to apache-airflow-providers-fab version 3.7.3 or later, which changes the default to verify_signature=True. The fix is available via the Apache Airflow advisory. No direct workaround is documented, but administrators can manually set verify_signature=True in the Azure AD OAuth configuration before upgrading, though this requires altering internal provider code or configuration mappings that may not be officially supported outside the patch.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today