Vulnerabilities in pkg:pypi/keystone

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-whqr-fgm5-x77q",
  "modified" : "2026-07-02T17:44:27Z",
  "published" : "2026-05-28T21:32:02Z",
  "aliases" : [ "CVE-2026-44394" ],
  "summary" : "OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token",
  "details" : "An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "keystone"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "14.0.0"
      }, {
        "fixed" : "27.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "keystone"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "28.0.0"
      }, {
        "fixed" : "28.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "keystone"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "29.0.0"
      }, {
        "fixed" : "29.0.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44394"
  }, {
    "type" : "WEB",
    "url" : "https://bugs.launchpad.net/keystone/+bug/2150379"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openstack/keystone"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-603.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://security.openstack.org/ossa/OSSA-2026-015.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-02T17:44:27Z",
    "nvd_published_at" : "2026-05-28T19:16:38Z"
  }
}