Sign in
Deutsch English Español Polski
Medium

OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token

  • Disclosed: 28.05.2026
  • Updated: 11.10.2026 15:17

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) keystone >= 14.0.0, < 27.0.2, >= 28.0.0, < 28.0.2, >= 29.0.0, < 29.0.2 27.0.2, 28.0.2, 29.0.2

References

CVSS score 6/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness (CWE)
CWE-863
Platform
Python (PyPI)
Package
keystone
Disclosed
28.05.2026
Updated
11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-603 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-whqr-fgm5-x77q - CC BY 4.0

Vulnerability history: keystone

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (42) in the archive
Total entries
42
First → latest
09.2012 05.2026
Without a fix
3
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 18
  • Medium 21
  • Low 1
  • Unrated 1

Disclosures per year

earlier: 13

Severity:
  1. OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token this entry
    Medium · 6.0 CVE-2026-44394 >= 14.0.0, < 27.0.2, >= 28.0.0, < 28.0.2, >= 29.0.0, < 29.0.2 27.0.2, 28.0.2, 29.0.2
  2. OpenStack Keystone has an Incorrect Authorization Issue
    High · 7.9 CVE-2026-43001 >= 13.0.0, <= 29.0.1 no fix
  3. OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean
    High · 7.7 CVE-2026-40683 < 28.0.1 28.0.1
  4. OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
    High · 7.5 CVE-2025-65073 < 26.0.1, >= 27.0.0.0rc1, < 27.0.0, >= 28.0.0.0rc1, < 28.0.0 26.0.1, 27.0.0, 28.0.0
  5. Openstack Keystone Incorrect Authorization vulnerability
    Critical · 9.1 CVE-2021-3563 <= 21.0.0 no fix
  6. OpenStack Keystone allows information disclosure during account locking
    High · 7.5 CVE-2021-38155 >= 10.0, < 16.0.2, >= 17.0, < 17.0.1, >= 18.0, < 18.0.1, >= 19.0, < 19.0.1 16.0.2, 17.0.1, 18.0.1, 19.0.1
  7. OpenStack Keystone Improper Authentication vulnerability
    High CVE-2012-4456 >= 2012.1, < 2012.1.2 2012.1.2
  8. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalat
    High · 8.8 CVE-2020-12689 < 15.0.1 15.0.1
  9. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then p
    High · 8.8 CVE-2020-12691 < 15.0.1 15.0.1
  10. Insufficient Session Expiration in OpenStack Keystone
    High · 8.8 CVE-2020-12690 < 15.0.1, >= 16.0.0.0rc1, < 16.0.0 15.0.1, 16.0.0
  11. OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforc
    High · 8.8 CVE-2019-19687 < 16.0.1 16.0.1
  12. An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and uninten
    High · 7.2 CVE-2017-2673 >= 9.0.0, < 10.0.2, >= 11.0.0, < 11.0.1 10.0.2, 11.0.1
  13. OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
    High · 7.5 CVE-2015-7546 >= 8.0, < 8.1.0, >= 9.0.0.0b1, < 9.0.0.0b2 8.1.0, 9.0.0.0b2
  14. OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
    High · 6.5 CVE-2014-5251 < 8.0.0a0 8.0.0a0
  15. OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events
    High · 6.5 CVE-2014-5252 < 8.0.0a0 8.0.0a0
  16. OpenStack Keystone Domain-scoped tokens don't get revoked
    High · 6.5 CVE-2014-5253 < 8.0.0a0 8.0.0a0
  17. OpenStack Identity (Keystone) DoS through V3 API authentication chaining
    High · 7.5 CVE-2014-2828 < 8.0.0a0 8.0.0a0
  18. OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend
    High · 6.5 CVE-2014-2237 < 8.0.0a0 8.0.0a0
  19. OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating
    High · 5.9 CVE-2012-5563 all versions no fix
  20. OpenStack Keystone Allows Remote User Account Creation
    High · 7.5 CVE-2012-3542 < 2012.1 2012.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.