CVE-2013-1865

OpenStack Keystone Improper Authentication vulnerability

6.8 MediumFix available

OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.

Exploit likelihood

2.63%Up 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2013-1865
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-1865
Updated: 2026-11-02

EUVDEUVD-2013-0014 No score

Record: EUVD-2013-0014
Updated: 2026-11-03

GitHub AdvisoriesGHSA-22q6-wwq7-2jj9 6.9

OpenStack Keystone Improper Authentication vulnerability

Record: GHSA-22q6-wwq7-2jj9
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVGHSA-22q6-wwq7-2jj9 6.9

OpenStack Keystone Improper Authentication vulnerability

Record: GHSA-22q6-wwq7-2jj9
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVRHSA-2013:0708 6.5

Red Hat Security Advisory: openstack-keystone security and bug fix update

Record: RHSA-2013:0708
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVPYSEC-2013-39 No score

Record: PYSEC-2013-39
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`keystone` PyPI	2012.2 up to 2012.2.4	2012.2.4
`openstack-keystone` Red Hat:openstack:2::el6	before 0:2012.2.3-7.el6ost	0:2012.2.3-7.el6ost
`openstack-keystone-doc` Red Hat:openstack:2::el6	before 0:2012.2.3-7.el6ost	0:2012.2.3-7.el6ost
`python-keystone` Red Hat:openstack:2::el6	before 0:2012.2.3-7.el6ost	0:2012.2.3-7.el6ost

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1865 is a medium vulnerability (CVSS 6.8) in Openstack Folsom, published March 22, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in keystone 2012.2.4.

References

Show 29 moreShow less