Search: CVE-2026-82311

CVE-2026-82311 is a critical vulnerability in the Apache Airflow FAB provider affecting deployments using the FAB auth manager with database-backed session storage. When a user's password is reset, existing sessions are not properly deleted due to a mismatch in identifier comparison, allowing an attacker with a stolen session cookie to maintain access even after the password change. This issue is fixed in version 3.9.0, which corrects the identifier comparison logic. The vulnerability has a CVSS score of 9.8, indicating high severity.