An authentication flaw in OpenStack Keystone allows an attacker to use their own application credential while specifying a different user, resulting in a token that appears to belong to the victim. This token is project‑scoped and inherits a mix of the attacker’s and victim’s roles, enabling privilege escalation, audit evasion, and access to the victim’s credentials within shared projects. The weakness originates from improper authorization checks (CWE‑303) and misuse of application credential verification (CWE‑863).

This issue affects OpenStack Keystone versions prior to 29.0.2. The vulnerability is present in the application credential authentication plugin used by Keystone. Only deployments running Keystone before the 29.0.2 release are impacted.

The CVSS score of 6.0 indicates a moderate severity. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation. The attack vector is remote through the Keystone API; an attacker needs a valid application credential to initiate the request. Exploitation yields an impersonated token that can be used to perform actions as the victim within their projects, enabling audit evasion and unauthorized read of the victim’s credentials.