Threats tagged 'ghsa-fc7p-hr7f-vwgr'

Apache Airflow's logout endpoint fails to properly revoke tokens on the server when revocation encounters errors, including database failures or tokens from external issuers with long identifiers. As a result, tokens remain valid after logout, allowing continued API access until token expiration. Users should upgrade to Apache Airflow 3.4.0 or later to address this issue.