The FAB auth manager's Azure AD OAuth login path defaulted verify_signature to False, allowing an attacker to supply a forged or unsigned ID token to the OAuth callback and bypass authentication, potentially logging in as any user, including administrators. This flaw, classified as CWE-347, occurs when a system accepts a token without verifying its signature, enabling exploitation of the primary authentication credential.

Deployments using apache-airflow-providers-fab older than version 3.7.3 with the default Azure AD OAuth configuration are affected; the Authentik path defaults to true, so it is not impacted.

The CVSS score of 9.8 underscores the severity, while the EPSS score of less than 1% indicates low current exploitation probability; the vulnerability is not listed in CISA KEV, and exploitation requires only supplying a forged token, making it a straightforward authentication bypass for remote attackers.