Cross-site Request Forgery (CSRF)

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the login authentication process due to missing generation and validation of the OAuth 2.0...

sqli-research

🔬 sqli-research Time-Based Blind SQL Injection — Riset, Po...

CVE-2026-40948

The Keycloak authentication manager in apache-airflow-providers-keycloak (versions prior to 0.7.0 ) is vulnerable to login-CSRF and session fixation because it fails to generate or validate the OAuth 2.0 state parameter during login and login-callback flows, and it lacks PKCE (Proof Key for Code ...

CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

GHSA-RCQX-GC76-R9MV

creationtimestamp| type| source ---|---|--- 2026-04-18 05:18:34+00:00| published-proof-of-concept| Telegram/veDSMFN7ecyhltWdKUwpcYAyE-ogEw-qfchv6YBZH7Zn1oc...

GHSA-CP2J-RWH4-R46F

creationtimestamp| type| source ---|---|--- 2026-04-18 05:18:34+00:00| published-proof-of-concept| Telegram/veDSMFN7ecyhltWdKUwpcYAyE-ogEw-qfchv6YBZH7Zn1oc...

GHSA-526V-VM72-4V64

creationtimestamp| type| source ---|---|--- 2026-04-18 05:18:34+00:00| published-proof-of-concept| Telegram/veDSMFN7ecyhltWdKUwpcYAyE-ogEw-qfchv6YBZH7Zn1oc...

GHSA-7R3F-9FWV-P43W

creationtimestamp| type| source ---|---|--- 2026-04-18 03:16:44+00:00| published-proof-of-concept| Telegram/uiCSDEnb8aQmWF7FrTZmjJQGi4eEk-7sLrqhzwnkCLApk...

GHSA-XJX3-GJH9-45FM

creationtimestamp| type| source ---|---|--- 2026-04-18 03:16:44+00:00| published-proof-of-concept| Telegram/uiCSDEnb8aQmWF7FrTZmjJQGi4eEk-7sLrqhzwnkCLApk...

GHSA-2JRC-X8FQ-PRVC

creationtimestamp| type| source ---|---|--- 2026-04-18 03:16:44+00:00| published-proof-of-concept| Telegram/uiCSDEnb8aQmWF7FrTZmjJQGi4eEk-7sLrqhzwnkCLApk...

GHSA-RG7M-6VH7-F4V2

creationtimestamp| type| source ---|---|--- 2026-04-18 03:16:44+00:00| published-proof-of-concept| Telegram/uiCSDEnb8aQmWF7FrTZmjJQGi4eEk-7sLrqhzwnkCLApk...

security-research

Security Research This project hosts security advisories and...

GHSA-8CWR-X83M-MH9X

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:44+00:00| published-proof-of-concept| Telegram/41gIjnqleUG-c7q5H5vmUlb-p3i15u65SeajvrPdO-zEo4...

GHSA-6QXV-XW9J-77PJ

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:44+00:00| published-proof-of-concept| Telegram/41gIjnqleUG-c7q5H5vmUlb-p3i15u65SeajvrPdO-zEo4...

GHSA-2932-77F9-62FX

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:44+00:00| published-proof-of-concept| Telegram/41gIjnqleUG-c7q5H5vmUlb-p3i15u65SeajvrPdO-zEo4...

GHSA-5W59-32C8-933V

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:19+00:00| published-proof-of-concept| Telegram/lPGIWgtQcs4RDQrNkGM74AEu7FEWLIcUMs54pp3qHTSOJE...

GHSA-HC37-VX3W-34FG

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:19+00:00| published-proof-of-concept| Telegram/lPGIWgtQcs4RDQrNkGM74AEu7FEWLIcUMs54pp3qHTSOJE...

GHSA-2M2V-V563-QQVJ

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:19+00:00| published-proof-of-concept| Telegram/lPGIWgtQcs4RDQrNkGM74AEu7FEWLIcUMs54pp3qHTSOJE...

GHSA-MCFQ-8RX7-W25V

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:19+00:00| published-proof-of-concept| Telegram/lPGIWgtQcs4RDQrNkGM74AEu7FEWLIcUMs54pp3qHTSOJE...

GHSA-QR3M-XW4C-JQW3

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:04+00:00| published-proof-of-concept| Telegram/u5f3Gra6Haipf3VJEB4yu-gwc95-0FLxvYnhbIvKSTo7fn8...