Skip to main content

Apache EUVDEUVD-2026-80323

| CVE-2026-76186 MEDIUM
Reliance on Cookies without Validation and Integrity Checking (CWE-565)
2026-09-15 GHSA-xhp3-rrf4-c8rv
Apache Information Disclosure
Share

Lifecycle Timeline

2
Patch available
Sep 16, 2026 - 10:02 EUVD
Analysis Generated
Sep 15, 2026 - 20:15 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

The Apache Airflow Keycloak provider (apache-airflow-providers-keycloak before 0.10.0), when running on Airflow 3.3 or later, performs authorization using Keycloak access and refresh tokens read from separate, unsigned cookies while taking the user's identity from the signed Airflow session token, and never verifies that both describe the same subject. Any user

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-565 – Reliance on Cookies without Validation and Integrity Checking

View all
CVE-2026-0257 HIGH POC
7.8
CVE-2022-50926 CRITICAL POC
9.8
CVE-2025-65212 CRITICAL POC
9.8
CVE-2023-35885 CRITICAL POC
9.8
CVE-2022-38297 CRITICAL POC
9.8
CVE-2017-6896 HIGH POC
8.8
CVE-2024-55211 HIGH POC
8.4
CVE-2018-19224 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-80323 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy