CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider 2.4.2-3.8.x password reset never deletes sessions because a string/int _user_id comparison is always false.