A critical session management vulnerability in the Apache Airflow FAB provider allows unauthorized access to persist even after a password reset, posing a severe risk to account security.

This is an insufficient session expiration flaw (CWE-613) where the application logic fails to invalidate active session tokens upon a password change. The vulnerability affects the Admin user-edit PATCH endpoint, and it is independent of authentication requirements as the session remains active regardless of the password change event.

The ability for an attacker to maintain persistent access after a password reset effectively nullifies the primary security measure for account recovery or compromise mitigation. With a CVSS score of 9.1, this vulnerability represents a critical risk, as it allows unauthorized actors to maintain full access to sensitive data and administrative functions despite security team intervention.

Immediate Action: Update the Apache Airflow FAB provider to version 3.9.0 or later immediately. Please note that previous patches for related session issues do not remediate this specific endpoint.

Proactive Monitoring: Review access logs for suspicious activity originating from existing user sessions that should have been terminated. Monitor for account usage patterns that do not align with expected user behavior following password updates.

Compensating Controls: Use a Web Application Firewall (WAF) to monitor and restrict access to the Admin user-edit endpoints. If possible, manually revoke active sessions via the database or management interface during incident response procedures.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS severity and the potential for persistent unauthorized access, organizations must prioritize upgrading to version 3.9.0 without delay. Security teams should verify that all deployments utilizing the FAB auth manager with database-backed sessions are updated, as this issue persists even in environments that have applied previous security patches. Failure to patch this vulnerability leaves user accounts vulnerable to permanent takeover by any actor possessing a valid session token.