CVE-2013-2059: OpenStack Identity (Keystone) improper revoking… (CVSS 6.0)

NVD Score used 6.0

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: CVE-2013-2059
CVSS 2.0: 6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: CVE-2013-2059
Updated: 2026-11-02

EUVDEUVD-2013-0016 No score

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: EUVD-2013-0016
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hj89-qmx9-8qmh 5.3

OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: GHSA-hj89-qmx9-8qmh
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVGHSA-hj89-qmx9-8qmh 5.3

OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: GHSA-hj89-qmx9-8qmh
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSV No score

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: CVE-2013-2059
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-2059 No score

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: DEBIAN-CVE-2013-2059
Updated: 2026-11-02

OSVPYSEC-2013-41 No score

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

Record: PYSEC-2013-41
Updated: 2026-11-02

Package	Affected	Fixed
`keystone` PyPI	before 8.0.0a0	8.0.0a0
`keystone` Debian:12	before 2013.1.1-2	2013.1.1-2
`keystone` Debian:13	before 2013.1.1-2	2013.1.1-2
`keystone` Debian:14	before 2013.1.1-2	2013.1.1-2

When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

CVE-2013-2059

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References