External risk intelligence

FAB Auth Manager Azure AD OAuth Signature Verification Bypass Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-59243

The vulnerability exists within an OAuth login callback mechanism. Authentication endpoints and identity portals are public-facing by design to facilitate user access, making this service commonly reachable from the internet in standard deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the FAB authentication manager when using Azure AD OAuth login with its default settings, allowing an attacker to bypass authentication by presenting a forged or unsigned ID token and gain access as any user, including administrators. Deployments using this default configuration are at risk, while other configurations may already be secured.

Forged login tokens can bypass authentication.
Critical access could be compromised without detection.
Verify and upgrade authentication configurations.

Attack Path

How an attacker could exploit the issue

An attacker could initiate an attack by sending a forged or unsigned ID token to the Azure AD OAuth login process. This bypasses signature verification, allowing the attacker to log in as any user, including an administrator, thereby gaining unauthorized access and control.

No special access required.
Forged ID token at OAuth callback.
Unauthorized access to user accounts.

Live Threat

Current exploitation, exposure, and threat context

When the FAB auth manager's Azure AD OAuth login is configured by default, an attacker could bypass authentication by presenting a forged or unsigned ID token. This could allow an attacker to log in as any user, including an administrator, when supported by the advisory's context.

Arbitrary user access.
Authentication bypass via forged token.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The FAB auth manager's Azure AD OAuth login is vulnerable if the `verify_signature` parameter defaults to `False` during ID token decoding. This allows an attacker to bypass authentication by presenting a forged or unsigned ID token to the OAuth callback, potentially gaining administrative access. The first practical step is to identify all instances of `apache-airflow-providers-fab` in your environment, confirm their reachability and business criticality, and then determine the accountable owner for remediation.

Application owners should own the issue.
Verify FAB auth manager Azure AD OAuth configurations.
Upgrade to `apache-airflow-providers-fab` 3.7.3.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FAB auth manager used for in Apache Airflow?

The FAB (Flask AppBuilder) auth manager is a component within Apache Airflow that handles how users sign in and gain access to the platform. It integrates with external identity providers, like Azure AD, to verify user credentials and manage session authentication, ensuring that only authorized individuals can interact with the workflow management environment.

How does CVE-2026-59243 allow an authentication bypass?

This vulnerability involves Improper Verification of Cryptographic Signature (CWE-347). The system incorrectly accepted ID tokens without validating their cryptographic signature. Because the software did not verify the token's authenticity, an attacker could submit a forged or unsigned token to the OAuth callback, tricking the system into granting them full access as any user, including an administrator.

Do I need to worry if I am not using Azure AD OAuth?

No. The vulnerability is specific to the Azure AD OAuth login path when configured with default settings that fail to verify signatures. If you are using different authentication providers, such as the Authentik path, you are not affected by this specific bug because those configurations already correctly mandate signature verification.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this service is very likely reachable from the internet. Because authentication endpoints and identity portals are designed to be public-facing to facilitate remote user access, standard deployments of this component are typically exposed, increasing the likelihood that an attacker could attempt to submit a forged token.

How do I fix the FAB auth manager vulnerability?

The primary step is to upgrade the `apache-airflow-providers-fab` package to version 3.7.3 or later. This update changes the default behavior of the Azure AD OAuth login process to enforce signature verification. You should inventory your environment to locate all instances of this provider and coordinate the update with the owners of those specific applications.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.