Sungwuk Jung

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 9.22.0 **Description** The AWS Auth Manager in Apache Airflow did not verify the origin of SAML authentication against the actual instance URL, relying instead on information provided by the client. This allowed for potential access to different instances with varying access controls by reusing SAML responses from other instances. **Recommendations** Upgrade to version 9.22.0 of the AWS Auth Manager provider.