{"cve":"CVE-2026-25604","nvd":{"published":"2026-03-09T11:16:06.077","modified":"2026-07-02T16:35:27.977","status":"Analyzed","description":"In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. \nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\n\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-346"],"references":["https://github.com/apache/airflow/pull/61368","https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77","http://www.openwall.com/lists/oss-security/2026/03/09/6"],"products":["apache:apache-airflow-providers-amazon"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-25604","score":0.00366,"percentile":0.30458,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-rv5f-ccpm-xjj4","url":"https://osv.dev/vulnerability/GHSA-rv5f-ccpm-xjj4","summary":"Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass","modified":"2026-09-10T03:50:40.926510501Z","packages":[{"ecosystem":"PyPI","name":"apache-airflow-providers-amazon","purl":"pkg:pypi/apache-airflow-providers-amazon","ranges":["<9.22.0"],"fixed":["9.22.0"]}]},{"id":"PYSEC-2026-2363","url":"https://osv.dev/vulnerability/PYSEC-2026-2363","summary":"Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass","modified":"2026-07-13T16:31:36.898496389Z","packages":[{"ecosystem":"PyPI","name":"apache-airflow-providers-amazon","purl":"pkg:pypi/apache-airflow-providers-amazon","ranges":["<9.22.0"],"fixed":["9.22.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}