CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Apache Answer User Center sessions can ignore central account suspension or deletion until they expire.
Stories per day · 30 days
2 RSS
Relatedauthentication2apache-airflow1apache-answer1cve-2026-865891cve-2026-968061jwt1keycloak1oss-security1user-center1
5 stories, newest first · one card per story
Stories tagged #session-management
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
Apache Airflow Keycloak logout fails to end sessions because middleware reissues an unrevoked JWT.
datasette-auth-github 1.0
Simon Willison released datasette-auth-github 1.0, fixing session cookies that lacked Max-Age and expired early, especially in Mobile Safari.
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Apache Airflow FAB provider 3.2.0-3.8.x password changes do not invalidate database-backed sessions, letting stolen session cookies survive a password reset.
CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider takes authorization tokens from unauthenticated cookies never checked against the signed session identity, enabling cookie substitution.