The bug causes the logout process in Apache Airflow's FabAuthManager and KeycloakAuthManager not to invoke revoke_token(). As a result, JWT tokens previously issued remain valid after a user logs out. Attackers who possess a JWT for a logged‑out user can continue to make authenticated API calls, effectively bypassing the intended session termination. This omission creates a residual gap that allows unauthorized API access until the token expires naturally.

The flaw affects installations of Apache Airflow that have configured either FabAuthManager or KeycloakAuthManager for authentication. Versions before 3.2.2 contain the bug, while the issue was fixed in apache-airflow 3.2.2 and later. Deployments using SimpleAuthManager are not impacted. Users who previously applied the fix for CVE-2025-57735 should also upgrade to 3.2.2 or newer to secure the logout paths.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability permits continued exploitation of a legitimate user’s token after logout, granting unauthorized access to protected API endpoints. The attack requires the attacker to have a JWT that was issued before the user logged out, a condition that can occur if the token was intercepted or reused. In the absence of KEV designation, no known active exploits are reported, but the risk remains medium to high for environments where token theft or reuse is possible.