Executive brief
OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
Affected products
- PyPI keystone
Junglewise Threat Intelligence
CVE-2025-65073: PYSEC-2026-1490 - OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
CVE-2025-65073 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: keystone (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2549 - OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
- PYSEC-2026-830 - OpenStack Keystone allows information disclosure during account locking
- PYSEC-2026-831 - OpenStack Identity Keystone Privilege Escalation vulnerability
- PYSEC-2026-833 - OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
- PYSEC-2026-832 - OpenStack Keystone Improper Authentication vulnerability