The FAB auth manager allows a deactivated user account’s previously issued Core API JWT to continue functioning. The token remains valid and can be used to mint a new token, effectively letting the account retain its role‑scoped access even after an administrator has disabled it. Password authentication correctly rejects the account, but the Core API accepts the existing unexpired token and grants new access. No credential forgery or privilege escalation occurs; the issue is a failure to invalidate tokens tied to a deactivated account.

Deployments running Apache Airflow version 3 with the FAB authentication provider and Core API token authentication are affected when an administrator deactivates an account whose database row remains intact and whose existing token has not expired. The vulnerability specifically impacts the apache‑airflow‑providers‑fab package; users should upgrade to version 3.9.0 or later, which rejects tokens identifying a deactivated account.

The vulnerability has no documented exploit probability (EPSS unavailable) and is not listed in the CISA KEV catalog, but it exposes users to indefinite access through valid tokens. The attack path requires an administrator to disable a user but leave the account record in place; an attacker can simply replay the remaining token to obtain new tokens. Because the compromised account’s role permissions are unchanged, the risk to confidentiality or integrity is limited to the scope of those roles, while availability is unaffected.