In Apache Airflow versions before 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
apache airflow