Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Airflow FAB provider

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-59243 Public exploit

    Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

    The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary u…

    Apache Software Foundation Apache Airflow FAB provider