This vulnerability arises from insufficient session expiration in Apache Airflow's FabAuthManager and KeycloakAuthManager logout flows. Specifically, the revoke_token() call is not reached during logout, leaving JWT tokens valid post-logout. This allows an attacker possessing a previously issued JWT to make authenticated API calls as the logged-out user until the token expires naturally. The issue is a follow-up to CVE-2025-57735, which fixed cookie-side invalidation but did not cover token revocation on the provider side. The vulnerability affects deployments using FabAuthManager or KeycloakAuthManager and is resolved by upgrading to Apache Airflow version 3.2.2 or later.

An attacker with a previously issued JWT token for a user who has logged out can continue to make authenticated API calls as that user until the token expires naturally. This undermines session termination and could lead to unauthorized access to user resources. The vulnerability does not affect SimpleAuthManager configurations. There are no known exploits in the wild at this time.

Users should upgrade Apache Airflow to version 3.2.2 or later to ensure that the logout flow properly calls revoke_token() for FabAuthManager and KeycloakAuthManager, fully invalidating JWT tokens upon logout. This upgrade complements the previous fix for CVE-2025-57735. No other mitigation steps are indicated by the vendor advisory. Patch status is not explicitly confirmed in the advisory, but the recommended upgrade version is 3.2.2 or later.