id: PYSEC-2026-1490
published: "2026-07-07T16:03:10.401718Z"
modified: "2026-07-07T17:24:24.082689Z"
aliases:
- CVE-2025-65073
- GHSA-hcqg-5g63-7j9h
summary: OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
details: OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.
affected:
- package:
    name: keystone
    ecosystem: PyPI
    purl: pkg:pypi/keystone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 26.0.1
    - introduced: 27.0.0.0rc1
    - fixed: 27.0.0
    - introduced: 28.0.0.0rc1
    - fixed: 28.0.0
  versions:
  - 12.0.2
  - 12.0.3
  - 13.0.2
  - 13.0.3
  - 13.0.4
  - 14.0.0
  - 14.0.1
  - 14.1.0
  - 14.2.0
  - 15.0.0
  - 15.0.0.0rc1
  - 15.0.0.0rc2
  - 15.0.1
  - 16.0.0
  - 16.0.0.0rc1
  - 16.0.0.0rc2
  - 16.0.1
  - 16.0.2
  - 17.0.0
  - 17.0.0.0rc1
  - 17.0.0.0rc2
  - 17.0.1
  - 18.0.0
  - 18.0.0.0rc1
  - 18.1.0
  - 19.0.0
  - 19.0.0.0rc1
  - 19.0.0.0rc2
  - 19.0.1
  - 20.0.0
  - 20.0.0.0rc1
  - 20.0.1
  - 21.0.0
  - 21.0.0.0rc1
  - 21.0.1
  - 22.0.0
  - 22.0.0.0rc1
  - 22.0.1
  - 22.0.2
  - 23.0.0
  - 23.0.0.0rc1
  - 23.0.1
  - 23.0.2
  - 24.0.0
  - 24.0.0.0rc1
  - 24.1.0
  - 25.0.0
  - 25.0.0.0rc1
  - 26.0.0
  - 26.0.0.0rc1
  - 27.0.0.0rc1
  - 28.0.0.0rc1
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2025-65073
- type: PACKAGE
  url: https://github.com/openstack/keystone
- type: WEB
  url: https://www.openwall.com/lists/oss-security/2025/11/04/2
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2025/11/17/6
- type: PACKAGE
  url: https://pypi.org/project/keystone
- type: ADVISORY
  url: https://github.com/advisories/GHSA-hcqg-5g63-7j9h
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N