{"action":"Upgrade apache-airflow-providers-keycloak to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0.0.1"}],"component":"apache-airflow-providers-keycloak","cve_ids":["CVE-2026-40948"],"ecosystem":"PyPI","epss":0.00404,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-5w6h-pjw6-wvc6","id":"tcs_01M5KF1VQ59DHKFCG6MJTW6C3S","modified_at":"2026-07-13T16:42:48.722973213Z","published_at":"2026-04-18T15:34:15Z","references":["https://osv.dev/vulnerability/GHSA-5w6h-pjw6-wvc6","https://nvd.nist.gov/vuln/detail/CVE-2026-40948","https://github.com/apache/airflow/pull/64114","https://github.com/apache/airflow","https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q","http://www.openwall.com/lists/oss-security/2026/04/17/14"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-5w6h-pjw6-wvc6","url":"https://osv.dev/vulnerability/GHSA-5w6h-pjw6-wvc6"}],"summary":"apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation"}