The AWS Auth Manager in Apache Airflow did not verify the origin of SAML authentication against the actual instance URL, relying instead on information provided by the client. This allowed for potential access to different instances with varying access controls by reusing SAML responses from other instances.