{"id":"CVE-2026-96806","title":"Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token","summary":"The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. …","severity":"none","cwe":["CWE-613"],"vendor":"Apache Software Foundation","product":"apache-airflow-providers-keycloak","affected":["apache-airflow-providers-keycloak < 0.11.1"],"published":"2026-10-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T03:39:05.417Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96806","references":[{"url":"https://github.com/apache/airflow/pull/73695"},{"url":"https://lists.apache.org/thread/7vwjg3wn8wxkprg6csxcvs6wkh301r0t"}],"tags":["cve.org"],"ingestedAt":"2026-10-15T22:48:25.376Z","slug":"CVE-2026-96806","body":"## Overview\n\nThe Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user.\n\nUsers of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.\n\n## Affected\n\n- `apache-airflow-providers-keycloak < 0.11.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}