{"id":"CVE-2021-3563","aliases":["DEBIAN-CVE-2021-3563","DLA-3714-1","EUVD-2022-6535","GHSA-cc99-whm5-mmq3","PYSEC-2026-370","UBUNTU-CVE-2021-3563","USN-7926-1"],"status":"published","title":"Openstack Keystone Incorrect Authorization vulnerability","description":"A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01863,"percentile":0.79415,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2022-08-26T15:25:41Z","modified":"2026-10-27T17:00:03Z","fixes":[{"ecosystem":"Debian:13","package":"keystone","fixed_in":["2:23.0.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"keystone","fixed_in":["2:23.0.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"keystone","fixed_in":["2:21.0.1-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"21.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:22.0.0-2","2:22.0.2-0+deb12u1","2:22.0.2-0+deb12u2","2:22.0.2-0+deb12u3","2:22.0.2-0+deb12u4","2:22.0.2-0+deb12u5","2:22.0.2-0+deb12u6","2:23.0.0-1","2:23.0.0-2","2:23.0.0-3","2:23.0.0-4","2:23.0.0-5","2:23.0.0-6","2:23.0.0~rc1-1","2:24.0.0-1","2:24.0.0-2","2:24.0.0-3","2:24.0.0~rc1-1","2:25.0.0-1","2:25.0.0-2","2:25.0.0-3","2:26.0.0-1","2:26.0.0-2","2:26.0.0-3","2:26.0.0-4","2:26.0.0~rc1-1","2:26.0.0~rc1-2","2:27.0.0-1","2:27.0.0-2","2:27.0.0-3","2:27.0.0~rc1-1","2:27.0.0~rc1-2","2:28.0.0-1","2:28.0.0-2","2:28.0.0-3","2:28.0.0-4","2:28.0.0-5","2:28.0.0-6","2:28.0.0~rc1-1","2:28.0.0~rc1-2","2:28.0.0~rc1-4","2:29.0.0-1","2:29.0.0-2","2:29.0.0-3","2:29.0.0~rc1-1","2:29.0.0~rc1-2","2:29.0.1-1","2:29.0.1-2","2:29.0.2-1","2:29.0.2-2","2:29.1.0-1","2:30.0.0-1","2:30.0.0-3","2:30.0.0~rc1-1","2:30.0.0~rc1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:23.0.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:23.0.0-3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.0-0+deb10u2"}]}],"versions":["2:14.0.1-2","2:14.2.0-0+deb10u1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"21.0.0"}]}],"versions":["12.0.2","12.0.3","13.0.2","13.0.3","13.0.4","14.0.0","14.0.1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.0.0.0rc2","15.0.1","16.0.0","16.0.0.0rc1","16.0.0.0rc2","16.0.1","16.0.2","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.0.1","18.0.0","18.0.0.0rc1","18.1.0","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","20.0.0","20.0.0.0rc1","20.0.1","21.0.0","21.0.0.0rc1"]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"21.0.0"}]}],"versions":["12.0.2","12.0.3","13.0.2","13.0.3","13.0.4","14.0.0","14.0.1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.0.0.0rc2","15.0.1","16.0.0","16.0.0.0rc1","16.0.0.0rc2","16.0.1","16.0.2","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.0.1","18.0.0","18.0.0.0rc1","18.1.0","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","20.0.0","20.0.0.0rc1","20.0.1","21.0.0","21.0.0.0rc1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:8.0.0-0ubuntu1","2:9.0.0~b1-0ubuntu1","2:9.0.0~b2-0ubuntu1","2:9.0.0~b3-0ubuntu1","2:9.0.0~rc1-0ubuntu1","2:9.0.0-0ubuntu1","2:9.0.2-0ubuntu1","2:9.0.2-0ubuntu2","2:9.1.0-0ubuntu1","2:9.2.0-0ubuntu1","2:9.3.0-0ubuntu1","2:9.3.0-0ubuntu2","2:9.3.0-0ubuntu3","2:9.3.0-0ubuntu3.1","2:9.3.0-0ubuntu3.2","2:9.3.0-0ubuntu3.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:12.0.0-0ubuntu1","2:13.0.0~b1-0ubuntu1","2:13.0.0~b2-0ubuntu1","2:13.0.0~b3-0ubuntu1","2:13.0.0~rc1-0ubuntu1","2:13.0.0~rc2-0ubuntu1","2:13.0.0-0ubuntu1","2:13.0.1-0ubuntu1","2:13.0.2-0ubuntu1","2:13.0.2-0ubuntu3","2:13.0.4-0ubuntu1","2:13.0.4-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:16.0.0-0ubuntu1","2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1","2:17.0.0~b2~git2020020513.99733f172-0ubuntu1","2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1","2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2","2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1","2:17.0.0-0ubuntu0.20.04.1","2:17.0.1-0ubuntu1","2:17.0.1-0ubuntu2","2:17.0.1-0ubuntu2+esm1","2:17.0.1-0ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.0.1-0ubuntu2.1"}]}],"versions":["2:20.0.0-0ubuntu1","2:20.0.0+git2021120815.2ddf8f321-0ubuntu1","2:20.0.0+git2022011217.771c943ad-0ubuntu1","2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1","2:21.0.0-0ubuntu1","2:21.0.1-0ubuntu1","2:21.0.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.0.1-0ubuntu2.1"}]}],"versions":["2:20.0.0-0ubuntu1","2:20.0.0+git2021120815.2ddf8f321-0ubuntu1","2:20.0.0+git2022011217.771c943ad-0ubuntu1","2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1","2:21.0.0-0ubuntu1","2:21.0.1-0ubuntu1","2:21.0.1-0ubuntu2"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openstack","product":"keystone"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://bugs.launchpad.net/ossa/+bug/1901891","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","VDB Entry","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962908","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","Vendor Advisory","report","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3563","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3563","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3563","tags":["advisory"]},{"url":"https://review.opendev.org/c/openstack/keystone/+/803641","tags":["web"]},{"url":"https://review.opendev.org/c/openstack/keystone/+/828595","tags":["web"]},{"url":"https://review.opendev.org/c/openstack/keystone/+/856489","tags":["web"]},{"url":"https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-370.yaml","tags":["web"]},{"url":"https://opendev.org/openstack/keystone","tags":["package"]},{"url":"https://pypi.org/project/keystone","tags":["web","package"]},{"url":"https://github.com/advisories/GHSA-cc99-whm5-mmq3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3563","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7926-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-65073","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3563","description":"A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.","status":"published","published":"2022-08-26T15:25:41Z","modified":"2025-02-13T16:28:24.713Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2022-6535","description":"A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.","status":"published","published":"2022-08-26T15:25:41Z","modified":"2025-02-13T16:28:24Z","updated_at":"2026-11-03T00:03:52.752782Z"}],"ghsa":[{"id":"GHSA-cc99-whm5-mmq3","title":"Openstack Keystone Incorrect Authorization vulnerability","description":"A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.","status":"published","published":"2022-08-27T00:00:44Z","modified":"2026-10-27T16:49:06Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:38.969831Z"}],"nvd":[{"id":"CVE-2021-3563","description":"A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.","status":"published","published":"2022-08-26T16:15:08.867Z","modified":"2026-06-17T04:05:21.04Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-3563","description":"A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.","status":"published","published":"2022-08-26T16:15:08.867Z","modified":"2026-10-24T10:30:44.001751126Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3563","description":"A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.","status":"published","published":"2022-08-26T16:15:08.867Z","modified":"2026-10-23T18:03:49.754512554Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-cc99-whm5-mmq3","title":"Openstack Keystone Incorrect Authorization vulnerability","description":"A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.","status":"published","published":"2022-08-27T00:00:44Z","modified":"2026-10-27T17:00:03.99307409Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2026-370","title":"Openstack Keystone Incorrect Authorization vulnerability","description":"A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.","status":"published","published":"2026-06-29T11:50:33.812046Z","modified":"2026-07-01T20:22:55.228672Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2021-3563","description":"A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.","status":"published","published":"2022-08-26T16:15:00Z","modified":"2026-09-30T18:21:23.353716982Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"DLA-3714-1","title":"keystone - security update","status":"published","published":"2024-01-21T00:00:00Z","modified":"2026-03-09T01:19:10.058396Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"USN-7926-1","title":"keystone vulnerabilities","description":"Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens\nand s3tokens APIs. A remote attacker could possibly use this issue to\nobtain unauthorized access and escalate privileges. (CVE-2025-65073)\n\nIt was discovered that OpenStack Keystone only validated the first 72\nbytes of an application secret. An attacker could possibly use this issue\nto bypass password complexity. (CVE-2021-3563)\n\nIt was discovered that OpenStack Keystone had a time lag before a token\nshould be revoked by the security policy. A remote administrator could use\nthis issue to maintain access for longer than expected. (CVE-2022-2447)","status":"published","published":"2025-12-11T14:24:04Z","modified":"2026-04-27T18:31:24.877333Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}