CVE-2025-65073 HIGH

CVE-2025-65073

Vendor Openstack
Product Keystone
Weakness CWE-863 · Incorrect authorization
Published November 17, 2025
Last update November 17, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

What the vulnerability does

01Description

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

Key dates

02Disclosure timeline

November 17, 2025 CVE published
November 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-12555 Incorrect Authorization in GitLab CVE-2026-28735 GitHub OAuth Scope Validation CVE-2026-6343 Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks CVE-2023-42124 Avast Premium Security Sandbox Protection Incorrect Authorization Privilege Escalation Vulnerability CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users