CVE-2025-65073

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-650747.2WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650756.5WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650766.1WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650778.8A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabili CVE-2025-650789.3An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabilit CVE-2025-650796.9A heap-based buffer overflow vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability CVE-2025-65084.3The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding CVE-2025-650806.9A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be lever CVE-2025-650816.9An out-of-bounds read vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be CVE-2025-650826.5Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the CVE-2025-650833.2GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSig CVE-2025-650849.8An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and