The vulnerability lies in OpenStack Keystone’s incomplete enforcement of delegation boundaries across trust, application credential, and OAuth1 endpoints. Tokens received through delegated authentication methods—such as OAuth1 access tokens or custom Keystone plugins—can be used to create trusts, persistent application credentials, and new OAuth1 delegations that grant roles beyond the token’s intended scope. As a result, a user possessing a narrow‑scope token can elevate privileges to the full user level and maintain long‑term access even after the original token is revoked.

Any OpenStack Keystone deployment that has not applied the vendor patch is potentially vulnerable, including all instances that rely on the default trust, application credential, or OAuth1 authorization endpoints. No specific version ranges are listed, meaning the issue applies generically to Keystone installations using these delegated authentication mechanisms.

The CVSS score of 8.1 indicates high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so the overall exploitation probability cannot be precisely quantified. An attacker must first authenticate to Keystone or already have a valid delegated token and then invoke one of the affected endpoints. When exploited, the flaw allows a narrow‑scope token holder to gain full user privileges and persistently maintain access, posing a significant risk in environments that use delegated token authentication.