The Apache Airflow FAB provider has an insufficient session expiration vulnerability (CWE-613) where the Admin user-edit PATCH endpoint for changing user passwords does not invalidate existing sessions stored in the database. Consequently, an attacker possessing a victim's session cookie retains access even after the victim's password is changed. This flaw affects versions from 3.2.0 up to but not including 3.9.0. It is an independent issue from CVE-2026-82311, which addressed a related session invalidation problem but did not cover this PATCH endpoint. Users are advised to upgrade to version 3.9.0 or later to remediate this issue.

An attacker who has obtained a victim's session cookie prior to a password change can continue to access the victim's account without interruption, bypassing the intended security measure of session invalidation upon password reset. This undermines the security of user sessions and may allow unauthorized persistent access despite password changes. The vulnerability requires that the attacker already possess a valid session cookie; no direct exploitation of the password change endpoint is needed.

Upgrade Apache Airflow FAB provider to version 3.9.0 or later, where this vulnerability is fixed. This upgrade ensures that password changes properly invalidate existing database-backed sessions. Deployments that have already applied the fix for CVE-2026-82311 must also upgrade to address this independent session invalidation flaw. No other mitigation is indicated by the vendor advisory.