PUBLISHED
2026-04-18 14:16
MODIFIED
2026-04-18 14:16
EPSS (Prob. Exploit)
0.36%
Top 71.7%
> DESCRIPTION
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-352: Cross-Site Request Forgery - The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
> GITHUB SECURITY ADVISORY
GHSA-5w6h-pjw6-wvc6
MODERATE
apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation
AFFECTED PACKAGES:
PIP / apache-airflow-providers-keycloak
>= 0.0.1, < 0.7.0
Fixed in: 0.7.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager
AFFECTED PACKAGES:
Unknown / Unknown
2936 versions affected
ALIASES:
GHSA-5w6h-pjw6-wvc6, PYSEC-2026-2369
> HISTORIQUE DES MODIFICATIONS
Première apparition
18/04/2026 14:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-352: Cross-Site Request Forgery (CSRF) - The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could hav...
Nouvelle valeur:
CWE-352: Cross-Site Request Forgery - The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have origi...
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-352: Cross-Site Request Forgery (CSRF) - The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could hav...
Total des modifications: 2
Dernière mise à jour: 1 week ago