Threats tagged 'ghsa-qfjc-4hpf-mgw2'

OpenStack Keystone versions before 29.0.3 contain a vulnerability where tokens obtained via delegated authentication methods can create, modify, or delete credentials without proper blocking. EC2-derived tokens can also read sensitive credential blobs, exposing TOTP MFA seeds and other secrets. Additionally, the PATCH /v3/credentials API does not validate the post-update project_id, allowing unauthorized project credential reassignment. This affects all Keystone deployments using delegated authentication.