Apache Airflow Providers Keycloak

1 result · Clear filters · Feed

• Medium 5.4
  CVE-2026-40948

  Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

  The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliv…

  Apache Software Foundation Apache Airflow Providers Keycloak apache-airflow-providers-keycloak PyPI
  Apr 18, 2026