This vulnerability in OpenStack Horizon occurs because the application performs a write operation to the session storage backend prior to authenticating the user. As a result, an attacker can send unauthenticated requests that consume session storage resources, potentially leading to denial of service by exhausting available storage. The flaw is a regression of a prior fix addressing a similar issue (CVE-2014-8124). The affected versions include 25.6.0 and 25.7 before 25.7.3. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability allows unauthenticated attackers to perform write operations to session storage, which can exhaust storage resources and degrade or deny service availability. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor OpenStack vendor advisories for updates. Until a fix is available, consider limiting exposure of the Horizon service to untrusted networks or implementing rate limiting to reduce the risk of storage exhaustion from unauthenticated requests.