CVE-2026-75156

Apache-airflow-providers-fab Security Flaw CVE-2026-75156 Disclosed

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login.