Threats Tagged 'cve-2026-80184'

OpenStack Keystone versions prior to 29.0.3 contain a vulnerability where tokens obtained through delegated authentication mechanisms such as OAuth1 access tokens, application credentials, or trusts can be used to bypass intended project scope restrictions. Specifically, when an application credential token without explicit scope is used, Keystone issues a new token scoped to the credential owner's default project instead of the intended project, allowing privilege escalation across project boundaries. This affects all Keystone deployments that allow delegated authentication via these mechanisms.

OpenStack Keystone versions 13.0.0, 28.0.0, and 29.0.0 contain an authorization flaw where tokens obtained via delegated authentication can be used to bypass intended project scope boundaries. Specifically, application credential tokens without explicit scope are incorrectly reauthenticated and scoped to the credential owner's default project instead of the intended project. This affects all Keystone deployments that allow delegated authentication through OAuth1 access tokens, application credentials, or trusts.