{"id":"CVE-2025-65073","aliases":["GHSA-hcqg-5g63-7j9h","PYSEC-2026-1490"],"title":"OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.","summary":"OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","vendor":"keystone","product":"keystone","ecosystem":"pip","affected":["keystone < 26.0.1","keystone >= 27.0.0.0rc1, < 27.0.0","keystone >= 28.0.0.0rc1, < 28.0.0"],"patched":["keystone 26.0.1","keystone 27.0.0","keystone 28.0.0"],"published":"2025-11-17","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hcqg-5g63-7j9h","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65073"},{"url":"https://github.com/openstack/keystone"},{"url":"https://www.openwall.com/lists/oss-security/2025/11/04/2"},{"url":"http://www.openwall.com/lists/oss-security/2025/11/17/6"}],"tags":["osv","pip"],"epss":0.00226,"epssPercentile":0.13591,"ingestedAt":"2026-07-08T18:25:50.052Z","slug":"CVE-2025-65073","body":"## Overview\n\nOpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.\n\n## Affected packages\n\n- `keystone < 26.0.1`\n- `keystone >= 27.0.0.0rc1, < 27.0.0`\n- `keystone >= 28.0.0.0rc1, < 28.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `keystone 26.0.1`\n- `keystone 27.0.0`\n- `keystone 28.0.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}