The Apache Airflow FAB provider has an insufficient session expiration vulnerability (CWE-613) where resetting a user's password fails to delete existing database-backed sessions. The root cause is a type mismatch in the session cleanup logic: the session stores a string identifier, while the database uses an integer user ID, so the comparison never matches and sessions remain active. This allows an attacker who has compromised a session cookie to retain access after the password reset. The vulnerability affects deployments using the FAB auth manager with the database session backend configured via `[fab] session_backend=database`. The issue is fixed in apache-airflow-providers-fab version 3.9.0, which also addresses a related independent vulnerability (CVE-2026-86462) via the Admin user-edit endpoint.

An attacker who has already obtained a victim's session cookie can continue to access the victim's account even after the victim or an administrator resets the password. This undermines the containment action of password resets by failing to evict active sessions, potentially allowing persistent unauthorized access.

Users should upgrade to apache-airflow-providers-fab version 3.9.0 or later, which fixes the session invalidation logic by correctly comparing user identifiers and deleting existing sessions upon password reset. No other mitigation is indicated or necessary once upgraded. The vulnerability only affects deployments using the FAB auth manager with the database session backend; other session backends such as secure-cookie are not affected.