OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

ALTO 7.5CVE-2025-65073 · GHSA-hcqg-5g63-7j9h · PYSEC-2026-1490 · Published 17/11/2025 · updated 18/10/2026

Package	Affected versions	Patched versions
keystone PyPI	`≥ 27.0.0.0rc1, < 27.0.0≥ 28.0.0.0rc1, < 28.0.0< 26.0.1`	`27.0.028.0.026.0.1`

Description

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

NVD description

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

References

nvd.nist.gov/vuln/detail/CVE-2025-65073 · ADVISORY
openstack/keystone · PACKAGE
openwall.com/lists/oss-security/2025/11/04/2 · WEB
openwall.com/lists/oss-security/2025/11/17/6 · WEB
pypi.org/project/keystone · PACKAGE
GitHub Advisory GHSA-hcqg-5g63-7j9h · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free