GHSA-5w6h-pjw6-wvc6

Source

https://github.com/advisories/GHSA-5w6h-pjw6-wvc6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5w6h-pjw6-wvc6/GHSA-5w6h-pjw6-wvc6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5w6h-pjw6-wvc6

Aliases

Published

2026-04-18T15:34:15Z

Modified

2026-07-13T16:42:48Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

Details

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade apache-airflow-providers-keycloak to 0.7.0 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-22T17:36:41Z",
    "nvd_published_at":  "2026-04-18T14:16:10Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / apache-airflow-providers-keycloak

Package

Name: apache-airflow-providers-keycloak; View open source insights on deps.dev
Purl: pkg:pypi/apache-airflow-providers-keycloak

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.0.1

Fixed

0.7.0

Affected versions

0.*

0.0.1

0.1.0rc1

0.1.0

0.2.0rc1

0.2.0

0.3.0rc1

0.3.0

0.4.0rc1

0.4.0

0.4.1rc1

0.4.1

0.5.0rc1

0.5.0

0.5.1rc1

0.5.1

0.5.2rc1

0.5.2

0.5.3rc1

0.5.3

0.6.0rc1

0.6.0

0.7.0rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5w6h-pjw6-wvc6/GHSA-5w6h-pjw6-wvc6.json"