An authentication header injection flaw in OpenStack keystonemiddleware’s external_oauth2_token middleware allows an attacker with valid credentials to send forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id. The middleware does not sanitize these incoming headers before processing OAuth 2.0 tokens, enabling an authenticated attacker to elevate privileges or impersonate other users, thereby compromising the confidentiality and integrity of the system. This vulnerability is classified as CWE-290, representing authentication bypass through insufficient input sanitization.

OpenStack keystonemiddleware versions 10.5 through 10.7 before 10.7.2, 10.8, and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1 are affected. Any deployment employing the external_oauth2_token middleware is vulnerable.

The vulnerability scores a CVSS vector of 9.9, indicating critical severity. Although the EPSS score is below 1%, suggesting a low probability of exploitation at present, the flaw remains critical due to the high impact and the ability to exploit with only authenticated access. The flaw is not listed in the CISA KEV catalog, yet the combination of high severity and potential for privilege escalation warrants urgent attention. An attack would involve an authenticated attacker submitting forged authentication headers to the middleware, allowing privilege escalation or user impersonation.