CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

<p>Posted by Vincent Beck on Sep 15</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.9.0<br /> <br /> Description:<br /> <br /> Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience <br /> claims of the id_token it accepts. An attacker holding a