Threats Tagged 'cve-2026-80182'

OpenStack Keystone versions prior to 29.0.3 contain a vulnerability where tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication can create new long-lived credentials or authorize new delegations that persist independently of the original credential. This occurs because delegation restrictions are inconsistently applied across delegated token types, allowing unauthorized creation of application credentials or OAuth1 request tokens. All Keystone deployments permitting delegated authentication through these methods are affected.

CVE-2026-80182 is a high-severity authorization vulnerability in OpenStack Keystone before version 29.0.3. It allows tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication to create new long-lived credentials or authorize new delegations that persist independently and outlive the original credential. The vulnerability arises because delegation restrictions do not consistently apply to all delegated token types, enabling unauthorized creation of application credentials or OAuth1 request tokens. This affects all Keystone deployments that permit delegated authentication through these token types.