The vulnerability in apache-airflow-providers-keycloak prior to version 0.7.0 involves missing generation and validation of the OAuth 2.0 'state' parameter and lack of PKCE usage in the login flow. This flaw enables login-CSRF or session fixation attacks where an attacker can trick a victim into authenticating into the attacker's session. The attacker can then access credentials stored by the victim in Airflow Connections. This issue affects Apache Airflow installations using the vulnerable Keycloak provider integration.

An attacker with a Keycloak account in the same realm can cause a victim to be logged into the attacker's Airflow session, potentially allowing the attacker to harvest credentials the victim stores in Airflow Connections. This compromises the confidentiality of sensitive credentials managed within Airflow. There are no known exploits in the wild as of the published date.

Users should upgrade apache-airflow-providers-keycloak to version 0.7.0 or later, where this vulnerability is addressed. No official patch or remediation level is explicitly stated in the advisory, but the upgrade recommendation indicates a fix is available in the specified version. Patch status is not yet confirmed by a vendor advisory, so users should verify with the official Apache Airflow or provider documentation for the latest remediation guidance.