CVE-2025-65073

unknown

Published 2025-11-17 · Modified 2025-11-18

CVSS v3

—

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

CVSS v2

—

VIR risk

—

Description

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-65073

OS	Version	Status	Fixed in
debian	bookworm	fixed	`2:22.0.2-0+deb12u1`
debian	bullseye	fixed	`2:18.1.0-1+deb11u2`
debian	forky	fixed	`2:28.0.0-2`
debian	sid	fixed	`2:28.0.0-2`
debian	trixie	fixed	`2:27.0.0-3+deb13u1`

Ecosystem	Package	Vulnerable	Fixed
PyPI	keystone	`<26.0.1`	`26.0.1`
PyPI	keystone	`>=27.0.0.0rc1,<27.0.0`	`27.0.0`
PyPI	keystone	`>=28.0.0.0rc1,<28.0.0`	`28.0.0`

Verify integrity in audit chain (admin only). AS-IS.