leanworld7-netizen opened a new issue, #70798: URL: https://github.com/apache/airflow/issues/70798
## Summary The Authentik OAuth provider in Apache Airflow FAB auth manager has three fall-through paths to unvalidated JWT decode even when verify_signature=True. Missing jwks_uri, empty JWKS, or failed JWKS fetch all bypass signature validation. ## Details PR #69374 fixed CVE-2026-59243 by changing verify_signature default from False to True for Azure AD. However, the Authentik OAuth provider (override.py L416-434) has three bypass paths: 1. Missing jwks_uri configuration: falls through to unvalidated decode 2. Empty JWKS key set: falls through to unvalidated decode 3. Failed JWKS fetch (network error): falls through to unvalidated decode All three paths result in JWT being accepted without signature verification, enabling authentication bypass. ## Impact Authentication bypass via Authentik OAuth when JWKS is misconfigured or unreachable. Sibling of CVE-2026-59243. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
