In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's /confirm endpoint.
/confirm
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*" ] }
"https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2022-40754.json"