Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `verify_signature` parameter in the Azure AD OAuth login defaulting to `False`, which disables JWT signature verification. An attacker can gain unauthorized access as any user, including those with administrative privileges, by presenting a forged or unsigned ID token to the OAuth callback. Note: This is only exploitable if the FAB auth manager is configured with the Azure AD OAuth login path using its default settings. How to fix Improper Verification of Cryptographic Signature? Upgrade `apache-airflow-providers-fab` to version 3.7.3 or higher.	[,3.7.3)

Improper Verification of Cryptographic Signature

apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the verify_signature parameter in the Azure AD OAuth login defaulting to False, which disables JWT signature verification. An attacker can gain unauthorized access as any user, including those with administrative privileges, by presenting a forged or unsigned ID token to the OAuth callback.

Note: This is only exploitable if the FAB auth manager is configured with the Azure AD OAuth login path using its default settings.

How to fix Improper Verification of Cryptographic Signature?

Upgrade apache-airflow-providers-fab to version 3.7.3 or higher.

[,3.7.3)

Go back to all versions of this package