CVE-2026-82311

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0

Description Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with [fab] session backend=database. This occurs because the cleanup process compares a string identifier stored by Flask-Login in the session against the user's integer database identifier, resulting in a mismatch that prevents session removal. Consequently, an attacker possessing a victim's session cookie maintains access even after a password reset. Additionally, a similar issue exists via the Admin user-edit endpoint.

Recommendations Upgrade to version 3.9.0 or later.