{"id":"CVE-2020-12690","aliases":["DEBIAN-CVE-2020-12690","DSA-4679-1","EUVD-2020-0096","GHSA-6m8p-x4qw-gh5j","PYSEC-2020-54","RHSA-2020:3102","RHSA-2020:3105","UBUNTU-CVE-2020-12690","USN-4480-1"],"status":"published","title":"Insufficient Session Expiration in OpenStack Keystone","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01896,"percentile":0.79802,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-613"],"published":"2020-05-06T00:00:00Z","modified":"2026-10-26T12:00:30Z","fixes":[{"ecosystem":"PyPI","package":"keystone","fixed_in":["15.0.1","16.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"keystone","fixed_in":["2:17.0.0~rc2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"keystone","fixed_in":["2:17.0.0~rc2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"keystone","fixed_in":["2:17.0.0~rc2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"keystone","fixed_in":["2:13.0.4-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0.0rc1"},{"fixed":"16.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:17.0.0~rc2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:17.0.0~rc2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:17.0.0~rc2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.0-0+deb10u1"}]}],"versions":["2:14.0.1-2"],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.1"}]}],"versions":["12.0.2","12.0.3","13.0.2","13.0.3","13.0.4","14.0.0","14.0.1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.0.0.0rc2"]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0.0rc1"},{"fixed":"16.0.0"}]}],"versions":["16.0.0.0rc1","16.0.0.0rc2"]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.1"}]}],"versions":["12.0.2","12.0.3","13.0.2","13.0.3","13.0.4","14.0.0","14.0.1","14.1.0","14.2.0","15.0.0.0rc1","15.0.0.0rc2","15.0.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.1-0.20200512110437.95b2bbe.el8ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python3-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.1-0.20200512110437.95b2bbe.el8ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.0.1-0.20200511063421.40cbb7b.el8ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"python3-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.0.1-0.20200511063421.40cbb7b.el8ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:8.0.0-0ubuntu1","2:9.0.0~b1-0ubuntu1","2:9.0.0~b2-0ubuntu1","2:9.0.0~b3-0ubuntu1","2:9.0.0~rc1-0ubuntu1","2:9.0.0-0ubuntu1","2:9.0.2-0ubuntu1","2:9.0.2-0ubuntu2","2:9.1.0-0ubuntu1","2:9.2.0-0ubuntu1","2:9.3.0-0ubuntu1","2:9.3.0-0ubuntu2","2:9.3.0-0ubuntu3","2:9.3.0-0ubuntu3.1","2:9.3.0-0ubuntu3.2","2:9.3.0-0ubuntu3.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.4-0ubuntu1"}]}],"versions":["2:12.0.0-0ubuntu1","2:13.0.0~b1-0ubuntu1","2:13.0.0~b2-0ubuntu1","2:13.0.0~b3-0ubuntu1","2:13.0.0~rc1-0ubuntu1","2:13.0.0~rc2-0ubuntu1","2:13.0.0-0ubuntu1","2:13.0.1-0ubuntu1","2:13.0.2-0ubuntu1","2:13.0.2-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.4-0ubuntu1"}]}],"versions":["2:12.0.0-0ubuntu1","2:13.0.0~b1-0ubuntu1","2:13.0.0~b2-0ubuntu1","2:13.0.0~b3-0ubuntu1","2:13.0.0~rc1-0ubuntu1","2:13.0.0~rc2-0ubuntu1","2:13.0.0-0ubuntu1","2:13.0.1-0ubuntu1","2:13.0.2-0ubuntu1","2:13.0.2-0ubuntu3"],"bundled":4}],"products":[{"vendor":"openstack","product":"keystone"}],"references":[{"url":"https://security.openstack.org/ossa/OSSA-2020-005.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://bugs.launchpad.net/keystone/+bug/1873290","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.openwall.com/lists/oss-security/2020/05/06/6","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2020/05/07/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4480-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12690","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6m8p-x4qw-gh5j","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-54.yaml","tags":["web"]},{"url":"https://usn.ubuntu.com/4480-1","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-12690","tags":["advisory"]},{"url":"https://github.com/openstack/keystone","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3102","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1833164","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3102.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12689","tags":["advisory"]},{"url":"https://security.openstack.org/ossa/OSSA-2020-004.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12690","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12692","tags":["advisory"]},{"url":"https://security.openstack.org/ossa/OSSA-2020-003.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3105","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3105.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-12690","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4480-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-12689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12692","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-12690","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2020-05-06T23:43:10Z","modified":"2024-08-04T12:04:22.54Z","updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-0096","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2020-05-06T23:43:10Z","modified":"2024-08-04T12:04:22Z","updated_at":"2026-11-03T03:07:39.896975Z"}],"ghsa":[{"id":"GHSA-6m8p-x4qw-gh5j","title":"Insufficient Session Expiration in OpenStack Keystone","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2021-06-09T17:34:09Z","modified":"2024-09-27T18:26:16Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2020-12690","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2020-05-07T00:15:10.923Z","modified":"2026-06-17T02:52:08.467Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-12690","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2020-05-07T00:15:10.923Z","modified":"2026-10-24T10:31:04.291832261Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-12690","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2020-05-07T00:15:10.923Z","modified":"2026-10-26T12:00:30.326113771Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-6m8p-x4qw-gh5j","title":"Insufficient Session Expiration in OpenStack Keystone","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2021-06-09T17:34:09Z","modified":"2024-09-27T18:35:07.1412Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHSA-2020:3102","title":"Red Hat Security Advisory: openstack-keystone security update","status":"published","published":"2024-09-14T00:40:45Z","modified":"2026-08-05T10:07:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3105","title":"Red Hat Security Advisory: openstack-keystone security update","status":"published","published":"2024-09-14T00:39:46Z","modified":"2026-08-05T10:07:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2020-12690","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2020-05-07T00:15:00Z","modified":"2026-09-30T18:21:20.210841453Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DSA-4679-1","title":"keystone - security update","status":"published","published":"2020-05-06T00:00:00Z","modified":"2026-03-09T02:11:31.521455Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"PYSEC-2020-54","description":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.","status":"published","published":"2020-05-07T00:15:00Z","modified":"2023-11-08T04:02:11.225655Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"USN-4480-1","title":"keystone vulnerabilities","description":"It was discovered that OpenStack Keystone incorrectly handled EC2\ncredentials. An authenticated attacker with a limited scope could possibly\ncreate EC2 credentials with escalated permissions. (CVE-2020-12689,\nCVE-2020-12691)\n\nIt was discovered that OpenStack Keystone incorrectly handled the list of\nroles provided with OAuth1 access tokens. An authenticated user could\npossibly end up with more role assignments than intended. (CVE-2020-12690)\n\nIt was discovered that OpenStack Keystone incorrectly handled EC2 signature\nTTL checks. A remote attacker could possibly use this issue to reuse\nAuthorization headers. (CVE-2020-12692)\n","status":"published","published":"2020-09-01T11:10:10Z","modified":"2026-04-27T15:41:00.305551Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}