CVE-2012-4413
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Exploit likelihood
What each source reports
NVD Score used
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
CVE-2012-4413- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
CVE-2012-4413- Updated
- 2026-11-02
EUVDEUVD-2022-4623 No score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
EUVD-2022-4623- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mrxv-65rv-6hxq No score
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
GHSA-mrxv-65rv-6hxq- Updated
- 2026-11-02
OSV No score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
CVE-2012-4413- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4413 No score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
DEBIAN-CVE-2012-4413- Updated
- 2026-11-02
OSVGHSA-mrxv-65rv-6hxq No score
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
GHSA-mrxv-65rv-6hxq- Updated
- 2026-11-02
OSVPYSEC-2026-833 No score
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
PYSEC-2026-833- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
before 2012.1.3 | 2012.1.3 |
keystoneDebian:12 |
before 2012.1.1-6 | 2012.1.1-6 |
keystoneDebian:13 |
before 2012.1.1-6 | 2012.1.1-6 |
keystoneDebian:14 |
before 2012.1.1-6 | 2012.1.1-6 |
keystonePyPI |
before 2012.1.3, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 |
2012.1.3 |
keystonePyPI |
before 2012.1.3, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 |
2012.1.3 |
openstack-keystoneRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
openstack-keystone-docRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystoneRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystone-auth-tokenRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4413 is a medium vulnerability (CVSS 4.0) in Openstack Keystone, published September 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in keystone 2012.1.3.
References
osvdb.org/85484
secunia.com/advisories/50531
openwall.com/lists/oss-security/2012/09/12/7
exchange.xforce.ibmcloud.com/vulnerabilities/78478
ubuntu.com/usn/USN-1564-1
securityfocus.com/bid/55524
Show 28 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-4413
access.redhat.com/errata/RHSA-2012:1378
bugs.launchpad.net/keystone/+bug/1041396
bugzilla.redhat.com/show_bug.cgi?id=855491
review.opendev.org/c/openstack/keystone/+/12870
web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524
github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e
security-tracker.debian.org/tracker/CVE-2012-4413
opendev.org/openstack/keystone
pypi.org/project/keystone
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1378.json
cve.org/CVERecord?id=CVE-2012-3542
Left out here: 31 versions. The JSON record has them.