Apache Airflow Fab Provider Insufficient Session Expiration Vulnerability

A vulnerability exists in Apache Airflow Fab Provider versions prior to 1.5.2, where sessions are not properly invalidated after a user password is changed via the admin CLI. This oversight allows users to remain logged in even after their password has been updated. In contrast, password changes made through the web interface do not exhibit this issue. This vulnerability is distinct from CVE-2023-40273, which has already been addressed in Apache Airflow 2.7.0.

Impact

Exploitation of this vulnerability allows for insufficient session expiration, enabling users to remain logged in after their password has been changed.

Reproduction

To reproduce this vulnerability, change a user's password using the Apache Airflow admin CLI. After the password is changed, the user will still be logged in, as the session has not been invalidated. This issue does not occur when the password is changed through the web interface.

Remediation

Users are advised to upgrade to Apache Airflow Fab Provider version 1.5.2 or later, which resolves this vulnerability.