https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T01:17:27.060339+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322641 EUVD-2026-322641 2026-10-05T01:17:27.144013+00:00 EUVD-2026-322641 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44394 fkie_cve-2026-44394 2026-10-05T01:17:27.144052+00:00

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

 https://cve.radiocsirt.org/vuln/ghsa-whqr-fgm5-x77q GHSA-whqr-fgm5-x77q — OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly iss… 2026-10-05T01:17:27.144091+00:00

Affected: PyPI: keystone

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

 https://cve.radiocsirt.org/vuln/pysec-2026-603 PYSEC-2026-603 2026-10-05T01:17:27.144123+00:00

Affected: PyPI: keystone

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44394 UBUNTU-CVE-2026-44394 2026-10-05T01:17:27.144146+00:00

Affected: Ubuntu:Pro:16.04:LTS: keystone, Ubuntu:Pro:18.04:LTS: keystone, Ubuntu:Pro:20.04:LTS: keystone, Ubuntu:22.04:LTS: keystone, Ubuntu:24.04:LTS: keystone, Ubuntu:25.10: keystone, Ubuntu:26.04:LTS: keystone

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.