GHSA-hcqg-5g63-7j9hHighCVSS 7.5

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

Published
November 17, 2025
Last Modified
November 18, 2025

🔗 CVE IDs covered (1)

CVE-2025-65073 →

📋 Description

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

🎯 Affected products3

  • pip/keystone:< 26.0.1
  • pip/keystone:= 27.0.0.0rc1
  • pip/keystone:= 28.0.0.0rc1

🔗 References (4)