The vulnerability lies in the Admin password‑edit PATCH endpoint of the Apache Airflow FAB provider, where changing a user’s password does not invalidate existing database‑backed sessions tied to that user. Because session cookies remain valid, any entity that already possesses a victim’s session cookie can continue to act with the victim’s credentials even after the password change. This flaw represents an improper session validation weakness (CWE‑613) and undermines the security guarantee that a password change revokes all active sessions.

Impact is limited using the FAB authentication manager configured for database‑backed sessions. The flaw applies to all versions prior to the release of version 3.9.0, which introduced a session‑invalidation mechanism during password changes.

The vulnerability can be exploited only if an attacker already has a session cookie for the target vulnerable endpoint is required. Because the EPSS score is 0.00195 (less than 1%) and the flaw is not listed in CISA’s KEV catalog, the exploitation that an attacker who already hijacked a session can persist indefinitely indicates a high potential impact. The network attack vector is indirect, depending on prior session compromise. The severity is elevated by the fact that a routine password change—which is a normal administrative action—fails to enforce the expected isolation of authenticated sessions.