The Apache Airflow FAB provider's Azure AD OAuth login component had a security flaw where the ID token signature verification was disabled by default (`verify_signature=False`). This improper verification (CWE-347) allowed an attacker to supply a forged or unsigned ID token (e.g., with `alg:none`) to the OAuth callback endpoint, bypassing authentication controls and logging in as any user, including administrators. The issue specifically affects versions of `apache-airflow-providers-fab` before 3.7.3. The fix in 3.7.3 changes the default to `verify_signature=True`, mitigating the risk. The Authentik login path was not affected as it already enforced signature verification.

An attacker able to present a forged or unsigned ID token to the vulnerable OAuth login endpoint can bypass authentication and gain unauthorized access as any user, including those with administrative privileges. This compromises the authentication mechanism, potentially allowing full control over the affected Airflow deployment's FAB provider authentication.

A patch is available in `apache-airflow-providers-fab` version 3.7.3, which changes the default setting to verify cryptographic signatures on ID tokens. Users should upgrade to version 3.7.3 or later to mitigate this vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side; users should verify with the vendor advisory for their deployment environment. No other mitigations are specified.