Vulnerability · Published Nov 17, 2025 · Assigned by mitre
CVE-2025-65073
High 7.5
In plain English
A high-severity incorrect authorization in Keystone from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.2%top 84.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | keystone | 2:22.0.2-0+deb12u1 | DEBIAN-CVE-2025-65073 |
| Debian:12 | keystone | 2:22.0.2-0+deb12u1 | DSA-6056-1 |
| Debian:13 | keystone | 2:27.0.0-3+deb13u1 | DSA-6056-1 |
| Debian:13 | keystone | 2:27.0.0-3+deb13u1 | DEBIAN-CVE-2025-65073 |
| Debian:14 | keystone | 2:28.0.0-2 | DEBIAN-CVE-2025-65073 |
| PyPI | keystone | 26.0.1, 27.0.0, 28.0.0 | PYSEC-2026-1490 |
| PyPI | keystone | 27.0.0 | GHSA-hcqg-5g63-7j9h |
| PyPI | keystone | 26.0.1 | GHSA-hcqg-5g63-7j9h |
| PyPI | keystone | 28.0.0 | GHSA-hcqg-5g63-7j9h |
| Ubuntu:22.04:LTS | heat | no fix listed | UBUNTU-CVE-2025-65073 |
| Ubuntu:24.04:LTS | heat | no fix listed | UBUNTU-CVE-2025-65073 |
| Ubuntu:25.10 | heat | no fix listed | UBUNTU-CVE-2025-65073 |
| Ubuntu:26.04:LTS | heat | no fix listed | UBUNTU-CVE-2025-65073 |
| Ubuntu:26.10 | heat | no fix listed | UBUNTU-CVE-2025-65073 |
| Ubuntu:22.04:LTS | keystone | 2:21.0.1-0ubuntu2.1 | USN-7926-1 |
| Ubuntu:22.04:LTS | keystone | 2:21.0.1-0ubuntu2.1 | UBUNTU-CVE-2025-65073 |
| Ubuntu:24.04:LTS | keystone | 2:25.0.0-0ubuntu1.1 | UBUNTU-CVE-2025-65073 |
| Ubuntu:25.10 | keystone | 2:28.0.0-0ubuntu1.1 | UBUNTU-CVE-2025-65073 |
| Ubuntu:26.04:LTS | keystone | 2:28.0.0-0ubuntu2 | UBUNTU-CVE-2025-65073 |
| Ubuntu:22.04:LTS | swift | 2.29.2-0ubuntu1.1 | UBUNTU-CVE-2025-65073 |
| Ubuntu:24.04:LTS | swift | 2.33.0-0ubuntu1.1 | UBUNTU-CVE-2025-65073 |
| Ubuntu:25.10 | swift | 2.36.0-0ubuntu1.1 | UBUNTU-CVE-2025-65073 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N