The FAB auth manager's Azure AD OAuth login defaulted verify_signature=False when decoding

The FAB auth

The FAB auth manager's Azure AD OAuth login defaulted verify_signature=False when decoding the ID token, so an attacker able to present a forged or unsigned (alg:none) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347).

Do this now

Disable Azure AD OAuth login until a fix is confirmed, and review recent logins for unexpected Admin-role accounts.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 23:17 UTC
Identifiers: CVE-2026-59243
CVSS: 9.8
Source: news
On the menu as: Azure / M365

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## The FAB auth manager's Azure AD OAuth login defaulted verify_signature=False when decoding
Severity: critical. Patch status: fix status unknown.
Affected: The FAB auth
Ids: CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verify_signature=False when decoding the ID token, so an attacker able to present a forged or unsigned (alg:none) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347).

## Steps
1. This incident involves a provider (azure). Search config, CI and env templates (.env.example, wrangler.toml, vercel.json, terraform, workflow secrets) for credentials stored there. List each secret by name, where it is used, and how to rotate it. Never print secret values.
2. There is no fix yet. Until one ships: The FAB auth manager's Azure AD OAuth login defaulted verify_signature=False when decoding the ID token, so an attacker able to present a forged or unsigned (alg:none) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347).

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-59243") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/apache/airflow/pull/69374 https://nvd.nist.gov/vuln/detail/CVE-2026-59243
https://pwned.coffee/i/the-fab-auth-manager-s-azure-ad-oauth-login-defaulted-ve-cve-2026-59243

Timeline

23 Oct 2026, 23:17 UTC
Proof-of-concept code for CVE-2026-59243 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee