apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

CVE-2026-40948

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: kubecolor, supercronic, kaf, prometheus-alertmanager, k8sgpt-operator, ctop, nri-haproxy, s5cmd, kubernetes-replicator, k6, db-operator, rancher-telemetry, ko, gostatsd, cloud-provider-vsphere, kapp, hcloud, rancher-system-agent, nfpm, nri-postgresql, jaeger-operator...