The vulnerability arises when Airflow fails to invalidate the JSON Web Token (JWT) after a user logs out. An attacker who can capture the active token—either by network interception or compromising the user’s environment—can reuse it to gain unauthorized access. This enables session hijacking and undermines confidentiality and integrity of authenticated sessions. The weakness aligns with CWE‑613, which addresses race conditions or improper invalidation of authentication tokens.

The weakness affects the Apache Airflow workflow orchestration platform maintained by the Apache Software Foundation. Versions older than 3.2.0 lack the logout token invalidation fix and are therefore vulnerable. Users running any Airflow release prior to 3.2.0 should check for an update.

The CVSS base score of 9.1 categorises the issue as critical, but the EPSS score below 1% indicates a low probability of active exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, if an attacker succeeds in intercepting a JWT token, the path to exploitation is straightforward: the token can be replayed to obtain authenticated access. The likely attack vector is interception of traffic or compromised client environments, which is inferred from the need to capture the token.