| Package | Affected versions | Patched versions |
|---|---|---|
| keystone | ≥ 14.0.0, < 27.0.2≥ 28.0.0, < 28.0.2≥ 29.0.0, < 29.0.2 | 27.0.228.0.229.0.2 |
| keystone | ≥ 14.0.0, < 27.0.2≥ 28.0.0, < 28.0.2≥ 29.0.0, < 29.0.2 | 27.0.228.0.229.0.2 |
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free