CVE-2025-65073

Description

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

EPSS Trends

Current EPSS score: 0.03%• Percentile: 9%

Techniques & Countermeasures

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

• openstack•keystone

  < 26.0.1 | 27.0.0 | 28.0.0

• PyPI•keystone

  < 26.0.1 | ≥ 27.0.0.0rc1, < 27.0.0 | ≥ 28.0.0.0rc1, < 28.0.0

References (4)

• https://www.openwall.com/lists/oss-security/2025/11/04/2
• http://www.openwall.com/lists/oss-security/2025/11/17/6
• https://nvd.nist.gov/vuln/detail/CVE-2025-65073
• https://github.com/openstack/keystone