CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVE-2016-4911
Medium (4.3) in keystone openstack identity. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in keystone 9.0.1.
The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- keystone:openstack_identity
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f82m-w3p3-cgp3 | PyPI | keystone | >=9.0.0 <9.0.1 | 9.0.1 |
| PYSEC-2016-38 | PyPI | keystone | >=9.0.0 <9.0.1 | 9.0.1 |