OpenStack Keystone versions prior to 29.0.2 contain an incorrect authorization vulnerability (CWE-863) in the application credential authentication plugin. The plugin does not verify that the user specified in the authentication request matches the owner of the application credential used. An attacker can exploit this by authenticating with their own application credential ID and secret but specifying a different user's name and domain in the request. Keystone then issues a project-scoped token attributed to the victim user, with roles intersecting the attacker’s credential roles and the victim’s project roles. This flaw enables impersonation within shared projects, potentially allowing audit evasion and unauthorized access to victim credentials.

The vulnerability allows an attacker with low privileges to impersonate another user within shared projects by obtaining a token attributed to the victim user. This token carries a limited set of roles but can be used to evade audit controls, read victim credentials, and act as the victim in the scope of the project. The CVSS score of 6.0 (medium severity) reflects the network attack vector, required low privileges, and the potential for limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor OpenStack Keystone advisories for updates addressing this issue. Until a fix is available, restrict use of application credentials and carefully audit project role assignments to limit potential abuse.