Apache Airflow versions using FabAuthManager or KeycloakAuthManager have an insufficient session expiration vulnerability (CWE-613) where JWT tokens are not revoked upon user logout. The logout process fails to invoke the revoke_token() call, allowing previously issued JWTs to remain valid until they expire naturally. This flaw permits continued authenticated API access by an attacker possessing a valid JWT from a logged-out user. This issue is a follow-up to CVE-2025-57735, which fixed cookie invalidation but missed the token revocation step in these authentication managers. The vulnerability is fixed in Apache Airflow version 3.2.2 and later.

An attacker with access to a previously issued JWT token for a user who has logged out can continue to make authenticated API calls as that user until the token expires naturally. This could lead to unauthorized access to the affected user's privileges within Apache Airflow. The vulnerability does not impact availability or integrity, only confidentiality through unauthorized access. There are no known exploits in the wild at this time.

Users should upgrade Apache Airflow to version 3.2.2 or later, which addresses the token revocation gap in the FabAuthManager and KeycloakAuthManager logout flows. This upgrade fully mitigates the vulnerability by ensuring JWT tokens are revoked upon logout. Since this is a software vulnerability in on-premises deployments, patching is required. No other mitigation or temporary workaround is indicated by the vendor advisory.