CVE-2026-44394
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
- CVSS 3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-25)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:keystone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-whqr-fgm5-x77q | PyPI | keystone | >=14.0.0 <27.0.2 | 27.0.2 |
| GHSA-whqr-fgm5-x77q | PyPI | keystone | >=28.0.0 <28.0.2 | 28.0.2 |
| GHSA-whqr-fgm5-x77q | PyPI | keystone | >=29.0.0 <29.0.2 | 29.0.2 |
| PYSEC-2026-603 | PyPI | keystone | >=14.0.0 <27.0.2 >=28.0.0 <28.0.2 >=29.0.0 <29.0.2 | 27.0.2, 28.0.2, 29.0.2 |