An OpenStack Keystone flaw permits an application credential token to escape its intended project scope during token‑method reauthentication. The system rejects an explicit scope change for these tokens but falls back to the owner’s default project when no scope is provided, issuing a new token scoped there while still showing the original application credential identity. Custom Keystone authentication plugins face a similar incomplete rescope guard. As a result, a limited‑scope application credential for one project can obtain tokens in another project where the owner holds roles, effectively expanding the attacker’s access rights.

The vulnerability affects any installation of OpenStack Keystone that has not yet applied the patch addressing token‑method reauthentication handling. No version details are supplied, so all current releases susceptible to the described logic error are impacted until updated.

With a CVSS score of 7.1, the flaw presents a moderate‑to‑high risk and could lead to unauthorized access across projects. The EPSS score is not available, indicating uncertainty about exploitation frequency, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires possession of a valid application credential; an attacker can trigger token reauthentication to obtain a token scoped to the owner’s default project, thereby exploiting the owner’s broader role assignments.