CVE-2026-96806

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1

Description The Keycloak auth manager fails to terminate the session during logout. While the logout route revokes the provided token, the KeycloakJWTMiddleware issues a new, unrevoked token within the same response, allowing the user to remain authenticated. This could allow an individual with subsequent access to the same browser, such as on a shared workstation, to continue acting as the previous user.

Recommendations Upgrade to apache-airflow-providers-keycloak 0.11.1 or later.