The Keystone federated token rescoping function does not carry over the original token's expiration to new tokens. When a federated user invokes POST /v3/auth/tokens to rescopes, the system returns a response missing expires_at, causing the provider to issue a token with a default TTL. By repeatedly rescopes before expiration, a user can keep a token alive indefinitely, circumventing operator‑set token life policies. This allows continuous access and can be seen as a variant of CVE‑2012‑3426.

OpenStack Keystone, versions earlier than 29.0.2, is affected. The flaw only exists in deployments that employ federated identity, such as SAML2 or OpenID Connect. Operators should review the version of Keystone in use and consider upgrading.

The CVSS score of 6 categorizes the flaw as moderate. The exploit hinges on a legitimate user possessing a federated token that can use the POST /v3/auth/tokens endpoint to rescopes. By repeating the rescopes before expiration, the attacker can maintain unlimited access, bypassing operator‑defined token lifetimes. The EPSS score indicates a very low likelihood of exploitation, reported as less than 1%, and the vulnerability is not listed in CISA KEV. Even though the CVSS rating is moderate, the persistence of unauthorized access makes it a significant threat to confidentiality and integrity for systems that rely on token expiration for access control.