CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

<p>Posted by Vincent Beck on Sep 15</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Airflow FAB provider (apache-airflow-providers-fab) 2.4.2 before 3.9.0<br /> <br /> Description:<br /> <br /> Apache Airflow FAB provider: resetting a user&apos;s password does not delete that user&apos;s existing database-backed sessions, <br /> despite documented behaviour that it doe