GitHub Advisoryadvisory · PyPI

GHSA-hcqg-5g63-7j9h OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

HIGH Published 2025-11-17 Modified 2025-11-18 Official page ↗
Aliases
CVE-2025-65073
Ecosystem
PyPI
Packages
keystone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Weaknesses
CWE-863
Reviewed
2025-11-17

Affected packages

• PyPI keystone: < 26.0.1 → fixed in 26.0.1 • PyPI keystone: >= 27.0.0.0rc1, < 27.0.0 → fixed in 27.0.0 • PyPI keystone: >= 28.0.0.0rc1, < 28.0.0 → fixed in 28.0.0

Description

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

Related

Alias · CVE (1)

  • CVE-2025-65073 OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References