The Apache Airflow FAB provider contains a critical session management vulnerability that permits unauthorized persistence of compromised user sessions following a password reset.

This vulnerability, classified as insufficient session expiration (CWE-613), occurs because the system fails to correctly compare session identifiers against user identifiers during password reset operations. This flaw allows an unauthenticated attacker, who has already obtained a victim's session cookie, to retain access even after the administrator or the user has performed a password reset.

The failure to properly invalidate sessions after a security event significantly undermines the effectiveness of password resets as a containment strategy. If an attacker has intercepted a session cookie, they maintain full access to the victim's account, leading to potential data exfiltration, unauthorized modification of workflows, or complete system compromise. With a CVSS score of 9.8, this vulnerability represents a critical risk to the confidentiality, integrity, and availability of the Airflow environment.

Immediate Action: Upgrade the apache-airflow-providers-fab package to version 3.9.0 or later to ensure consistent identifier comparison and proper session termination.

Proactive Monitoring: Review authentication logs and audit trails for persistent sessions that remain active following password change events.

Compensating Controls: If immediate patching is not feasible, consider implementing stricter session timeouts and deploying a Web Application Firewall to monitor for anomalous cookie usage patterns.

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Given the critical severity of this vulnerability and the ease of exploitation for attackers who have already obtained session tokens, immediate action is required. Organizations using the FAB auth manager with the database backend should prioritize the update to version 3.9.0, which also addresses additional security concerns. Delaying this patch leaves the system vulnerable to persistent unauthorized access by attackers who have bypassed initial authentication barriers.