EUVD-2026-50216
GHSA-q5r3-w69r-hrfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach the Airflow OAuth callback endpoint
-
DeliveryCraft a JWT with alg:none and forged Admin claims
-
ExploitSend the token to /oauth-authorized/azure
-
ExecutionServer skips signature verification and issues a session
-
ImpactAttacker gains Admin access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | The target deployment must use the Apache Airflow FAB auth manager with Azure AD OAuth login enabled in its default configuration (i.e., without explicitly setting |
| Impact | While Apache classifies this as moderate, independent CVSS analysis yields a critical 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because an attacker with network access to the OAuth callback can gain admin privileges with trivial effort (forging a token requires no authentication or user interaction). No EPSS score or KEV listing is available, indicating that widespread exploitation has not been observed publicly, but the default insecure configuration makes many deployments vulnerable until patched. The risk is high for organizations using Azure AD OAuth integration with Airflow, as full compromise is possible. Exploitation does not require any existing privileges; however, the target must have the Azure AD OAuth endpoint enabled (default). |
| Exploit ScenarioDerived | An attacker identifies an Airflow instance using the FAB auth manager with Azure AD OAuth. After constructing a JWT with |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from verify_signature defaulting to False, enabling acceptance of unsigned or algorithm-none tokens.
RemediationAI
Upgrade to apache-airflow-providers-fab version 3.7.3 or later, which changes the default to verify_signature=True. The fix is available via the Apache Airflow advisory. No direct workaround is documented, but administrators can manually set verify_signature=True in the Azure AD OAuth configuration before upgrading, though this requires altering internal provider code or configuration mappings that may not be officially supported outside the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in the FAB auth manager’s OAuth login module for Azure AD within apache-airflow-providers-fab. During ID token decoding, the verify_signature parameter defaulted to False, bypassing JWT signature validation (CWE-347: Improper Verification of Cryptographic Signature). An attacker can craft a token with the alg:none header and arbitrary claims (e.g., user identity, admin role) to impersonate any user. The issue is specific to the Azure AD path; the Authentik OAuth path already enforced verification. The exact affected product is apache-airflow-providers-fab before version 3.7.3.
Know when Jwt Attack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible endpoint, trivial token forgery (low complexity), no privileges or user interaction required, full compromise of confidentiality, integrity, and availability.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 1
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated a
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Exploit-DB