CVE-2012-5563
OpenStack Keystone Insufficient token expiration
CVE-2012-5563 is a medium vulnerability (CVSS 4.0) in Openstack Folsom, published December 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. Fixed in keystone 8.0.0.
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Exploit likelihood
What each source reports
NVD Score used
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
CVE-2012-5563- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
CVE-2012-5563- Updated
- 2026-11-02
EUVDEUVD-2012-0014 No score
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
EUVD-2012-0014- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w66p-78g4-mr7g
OpenStack Keystone Insufficient token expiration
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
GHSA-w66p-78g4-mr7g- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-324, CWE-863
- Updated
- 2026-11-02
OSVGHSA-w66p-78g4-mr7g
OpenStack Keystone Insufficient token expiration
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
GHSA-w66p-78g4-mr7g- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-324, CWE-863
- Updated
- 2026-11-02
OSVPYSEC-2012-20 No score
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
PYSEC-2012-20- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
before 8.0.0 | 8.0.0 |
keystonePyPI |
All versions, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 |
None known |
openstack-keystoneRed Hat:openstack:2::el6 |
before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
openstack-keystone-docRed Hat:openstack:2::el6 |
before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
python-keystoneRed Hat:openstack:2::el6 |
before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
rhn.redhat.com/errata/RHSA-2012-1557.html
openwall.com/lists/oss-security/2012/11/28/5
github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
securityfocus.com/bid/56727
ubuntu.com/usn/USN-1641-1
Show 20 moreShow less
bugs.launchpad.net/keystone/+bug/1079216
secunia.com/advisories/51423
exchange.xforce.ibmcloud.com/vulnerabilities/80370
nvd.nist.gov/vuln/detail/CVE-2012-5563
web.archive.org/web/20200228144943/http://www.securityfocus.com/bid/56727
access.redhat.com/errata/RHSA-2012:1557
bugzilla.redhat.com/show_bug.cgi?id=879402
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1557.json
cve.org/CVERecord?id=CVE-2012-5563
Left out here: 20 versions. The JSON record has them.