The Apache Airflow FAB provider's Azure AD OAuth login path had a default configuration where the ID token's cryptographic signature verification was disabled (`verify_signature=False`). This improper verification (CWE-347) allows an attacker who can present a forged or unsigned (`alg:none`) ID token to bypass authentication and log in as any user, including admins. The vulnerability affects all versions of `apache-airflow-providers-fab` prior to 3.7.3. The Authentik OAuth path was not affected as it already enforced signature verification. The vendor fixed the issue by changing the default to `verify_signature=True` in version 3.7.3.

An attacker can bypass authentication by presenting a forged or unsigned ID token, gaining unauthorized access to the system as any user, including those with administrative privileges. This leads to full compromise of the affected Apache Airflow deployments using the vulnerable FAB provider with Azure AD OAuth login under default settings. The CVSS score of 9.8 reflects the critical impact with network attack vector, no privileges or user interaction required, and high confidentiality, integrity, and availability impacts.

A patch is available in `apache-airflow-providers-fab` version 3.7.3, which changes the default setting to verify cryptographic signatures on ID tokens (`verify_signature=True`). Users should upgrade to version 3.7.3 or later to remediate this vulnerability. Since this is a cloud service component, the vendor manages remediation for cloud-hosted deployments; users should verify their environment is updated accordingly.