CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider 2.4.2-3.8.x password reset never deletes sessions because a string/int _user_id comparison is always false.
CVE-2026-82311 affects apache-airflow-providers-fab versions 2.4.2 before 3.9.0. Resetting a user's password fails to delete that user's existing database-backed sessions despite documented behavior saying it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison always evaluates false. Severity is rated moderate.
- Affects apache-airflow-providers-fab 2.4.2 before 3.9.0
- Password reset does not delete database-backed sessions
- String vs integer _user_id comparison always false
- Documented session-invalidation behavior broken since 2.4.2
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-82311 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow FAB provider (apache-airflow-providers-fab) 2.4.2 before 3.9.0 Description: Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
This source does not provide full text. Read it at seclists.org.