CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

<p>Posted by Niko Oliveira on Sep 08</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Airflow FAB provider (apache-airflow-providers-fab) 3.7.3 before 3.8.1<br /> <br /> Description:<br /> <br /> Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s <br /> during OAuth login. Deployments are affected only