This vulnerability in OpenStack Keystone versions 14.0.0, 28.0.0, and 29.0.0 arises because the federated token rescoping process does not carry forward the expiry time of the original token when issuing a new token. As a result, users can repeatedly rescope tokens to maintain access indefinitely, circumventing configured token lifetime restrictions. This issue specifically impacts deployments using federated identity protocols such as SAML2 and OpenID Connect. It is a variant of CVE-2012-3426 and affects token expiration enforcement in federated authentication scenarios.

An attacker with the ability to rescope federated tokens can bypass token expiration policies, maintaining access indefinitely. This leads to prolonged unauthorized access with potential confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: Low). There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the OpenStack vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Users should monitor OpenStack Keystone advisories for updates addressing this issue. Until a fix is available, consider limiting federated token rescoping or enforcing additional access controls where feasible.