# CVE-2026-44394: OpenStack Keystone authentication expiry bypass in federated token rescoping

Source: https://junglewise.ai/threats/cve-2026-44394-openstack-keystone-authentication-expiry-bypass-in-federated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-44394 · Severity: medium · CVSS 6 · Published 2026-05-28

OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles login sessions for users authenticated via external identity providers (like SAML or OpenID Connect). When these users switch between different projects or roles, the system incorrectly resets their session timer instead of keeping the original expiration date. This allows a user to stay logged in indefinitely by repeatedly switching roles, potentially maintaining access to cloud resources even after their corporate account has been disabled or revoked.

Technologies: [keystone (PyPI)](https://junglewise.ai/threats/technologies/keystone). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44394 being exploited in the wild.

**How severe is CVE-2026-44394?** Medium severity, with a CVSS score of 6, published 28 May 2026.

**Which products and versions are affected?** keystone (PyPI) ECOSYSTEM:introduced=14.0.0,fixed=27.0.2, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.

**Is there a fix for CVE-2026-44394?** Yes. keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44394 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44394?** Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later

  ```sh
  pip install "keystone>=29.0.2"
  ```


## Technical details

A vulnerability in OpenStack Keystone's federated authentication plugin allows for session lifetime extension. When a federated user (SAML2/OIDC) performs a token rescope via 'POST /v3/auth/tokens', the 'handle_scoped_token()' function in 'keystone/auth/plugins/mapped.py' fails to include the 'expires_at' attribute in the response data. Consequently, the token provider defaults to a fresh Time-To-Live (TTL) for the new token rather than inheriting the remaining lifespan of the original token. An authenticated attacker can exploit this by repeatedly rescoping their token before it expires to bypass operator-configured session limits and maintain access after upstream revocation. This issue is fixed in versions 27.0.2, 28.0.2, and 29.0.2.

## Affected products

- OpenStack Keystone >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2

## Identifiers

- CVE-2026-44394
- GHSA-whqr-fgm5-x77q
- PYSEC-2026-603

## Timeline

- 2026-04-26: disclosed: Bug reported to OpenStack Launchpad
- 2026-05-28: advisory: OSSA-2026-015 and GHSA published
- 2026-05-28: patched: Patched versions released

## References

- [https://bugs.launchpad.net/keystone/+bug/2150379](https://bugs.launchpad.net/keystone/+bug/2150379)
- [https://security.openstack.org/ossa/OSSA-2026-015.html](https://security.openstack.org/ossa/OSSA-2026-015.html)
- [https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-603.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-603.yaml)

## Related threats

- [PYSEC-2026-2549 - OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials](https://junglewise.ai/threats/cve-2015-7546-openstack-identity-keystone-and-keystonemiddleware-insufficiently)
- [PYSEC-2026-830 - OpenStack Keystone allows information disclosure during account locking](https://junglewise.ai/threats/cve-2021-38155-openstack-keystone-allows-information-disclosure-during-account)
- [PYSEC-2026-831 - OpenStack Identity Keystone Privilege Escalation vulnerability](https://junglewise.ai/threats/cve-2013-4477-openstack-identity-keystone-privilege-escalation-vulnerability)
- [PYSEC-2026-833 - OpenStack Keystone does not invalidate existing tokens when granting or revoking roles](https://junglewise.ai/threats/cve-2012-4413-openstack-keystone-does-not-invalidate-existing-tokens-when)
- [PYSEC-2026-832 - OpenStack Keystone Improper Authentication vulnerability](https://junglewise.ai/threats/cve-2012-4456-openstack-keystone-improper-authentication-vulnerability)