In Apache Airflow versions before 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
apache airflow