---
id: CVE-2026-25604
title: "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\_\nThis allowed to gain access to different instances with potentially different access co…"
summary: "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\_\nThis allowed to gain access to different instances with potentially different access co…"
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-346
vendor: apache
product: apache-airflow-providers-amazon
affected:
  - 'apache-airflow-providers-amazon >= 8.0.0, < 9.22.0'
patched:
  - apache-airflow-providers-amazon 9.22.0
published: '2026-03-09'
updated: '2026-07-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25604'
references:
  - url: 'https://github.com/apache/airflow/pull/61368'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/03/09/6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25604'
  - url: >-
      https://github.com/apache/airflow/commit/1a86aec01d827ba8caf41b645db56663a9a61850
  - url: 'https://github.com/apache/airflow'
tags:
  - nvd
  - exploit-available
  - osv
  - pip
epss: 0.00359
epssPercentile: 0.2977
ingestedAt: '2026-07-02T16:39:34.562Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/John-Jung/CVE-2026-25604-PoC'
  checkedAt: '2026-09-24T07:53:01.223Z'
exploitAvailable: true
aliases:
  - GHSA-rv5f-ccpm-xjj4
  - PYSEC-2026-2363
ecosystem: pip
---

## Overview

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. 
This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.

You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

## Affected

- `apache-airflow-providers-amazon >= 8.0.0, < 9.22.0`

## Remediation

Upgrade past the affected range:

- `apache-airflow-providers-amazon 9.22.0`

## Package advisory (CVE-2026-25604)

Affected packages:

- `apache-airflow-providers-amazon < 9.22.0`

Patched in:

- `apache-airflow-providers-amazon 9.22.0`

Source: https://osv.dev/vulnerability/GHSA-rv5f-ccpm-xjj4