Apache Airflow versions from 3.0.0b3 up to but not including 3.2.2 contain a vulnerability in the login redirect route that allows authenticated users to bypass the `is_safe_url` check. This flaw enables redirection from a trusted Airflow domain to an attacker-controlled origin. The issue is fixed in version 3.2.2. Operators are advised to upgrade to 3.2.2 or later. As an additional mitigation, deploying Airflow behind a reverse proxy that removes off-domain `next=` query parameters before they reach the login endpoint can reduce risk.