title: Session Fixation
description: In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
problem types: CWE-384 Session Fixation
affected:
{
product: Apache Airflow
vendor: Apache Software Foundation
versions:
lessThan: Apache Airflow*, status: affected, version: 2.2.4, versionType: custom
}