News · via oss-security
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
Posted by Jarek Potiuk on Oct 15 Severity: moderate Affected versions: - Apache Airflow Keycloak provider before 0.11.1 Description: The Apache Airflow Keycloak auth manager did not end the session…