CVE-2016-4911: Keystone Openstack Identity

Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days.

The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.

Affected products

• Keystone Openstack Identity: version 9.0.0.0 only

Published 2016-06-13. Last modified 2026-06-17.