CVE-2012-5563: OpenStack Keystone Token Chaining Authorization Bypass
Summary
CVE-2012-5563: OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through t... Affects keystone across 2 version ranges.
< 38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
< f9d4766249a72d8f88d75dcf1575b28dd3496681
Fixed in 38c7e46a640a94da4da89a39a5a1ea9c081f1eb5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an identity service that provides authentication and authorization for other OpenStack services. It manages user credentials and provides tokens for accessing resources. Keystone is a critical component of OpenStack Folsom 2012.2.
Vulnerability Detail
OpenStack Keystone in OpenStack Folsom 2012.2 does not properly implement token expiration, allowing remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. This vulnerability is a regression of CVE-2012-3426. Token chaining allows an attacker to create new tokens using existing tokens, bypassing the intended expiration and authorization checks. This can lead to unauthorized access to resources and potential privilege escalation.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
This is the first release that contains the fix.
pip install --upgrade "keystone==38c7e46a640a94da4da89a39a5a1ea9c081f1eb5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as soon as possible.
Conclusion
OpenStack Keystone in OpenStack Folsom 2012.2 is vulnerable to an authorization bypass issue through token chaining. This can lead to unauthorized access and potential privilege escalation. It is crucial to upgrade to a fixed version of Keystone to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an identity service that provides authentication and authorization for other OpenStack services.
Token chaining is a technique where an attacker creates new tokens using existing tokens, bypassing expiration and authorization checks.
This vulnerability allows remote authenticated users to bypass authorization restrictions and potentially gain unauthorized access to resources.
Yes, the vulnerability has been fixed in the latest versions of OpenStack Keystone.
No, there is no known workaround. It is recommended to apply the fix as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
