Resetting a user's password in Apache Airflow’s FAB provider never removes that user's existing database‑backed sessions because the cleanup logic compares a string session identifier with an integer database identifier, causing the comparison to always fail. As a result, an attacker who already possesses a valid session cookie can continue to act as the user even after the password has been changed. This flaw undermines the documented expectation that a password reset should invalidate all active sessions and can lead to ongoing unauthorized access, compromising confidentiality and integrity of the affected account and potentially exposing sensitive data or privileges.

The vulnerability affects deployments that run the FAB authentication manager with the database session backend, specifically the Apache Airflow FAB provider product. Any installation using a version of apache-airflow-providers-fab prior to 3.9.0 is susceptible. The issue does not occur when using the secure‑cookie backend, which is explicitly excluded from this behavior.

The flaw does not enable a new remote attacker to gain access; it requires that the attacker already own a session cookie. Exploitation therefore depends on prior compromise or social engineering to acquire a valid cookie. Because the issue directly permits continued session use after a password reset, the risk is high for any compromised accounts, essentially allowing persistent account takeover until the affected software is upgraded. No EPSS score or KEV listing is available, but the severity consideration is that the flaw violates a core security promise and can have significant impact. The likely attack vector is reuse of a stolen or snared session cookie combined with a password‑reset action performed by an attacker or by a malicious privileged user.