{"id":"CVE-2021-3563","kind":"vulnerability","aliases":["CVE-2021-3563","GHSA-cc99-whm5-mmq3"],"related":[],"title":"Openstack Keystone Incorrect Authorization vulnerability","description":"A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.","summary":"OpenStack Keystone, the identity service, verifies only the first 72 characters of an application secret. An attacker can therefore use a secret that matches the first 72 characters and gets past the password complexity rules administrators rely on.","severity":"critical","cvss":9.1,"epss":0.01863,"exploited":false,"exploited_at":null,"products":[{"name":"keystone","fixed":[],"affected":"<= 21.0.0","ecosystem":"pypi"},{"name":"openstack keystone","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"redhat openstack platform","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"redhat openstack platform","fixed":[],"affected":"= 13.0","ecosystem":"vendor"},{"name":"redhat openstack platform","fixed":[],"affected":"= 16.1","ecosystem":"vendor"},{"name":"redhat openstack platform","fixed":[],"affected":"= 16.2","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-863","keystone","openstack","package","python","self-hosted"],"not_affected_if":["not-using-application-secrets","patched-version"],"how_to_check":"- Check the installed keystone version with `pip show keystone` and compare it to the affected range (<= 21.0.0).\n- Review application credential or secret policies in keystone.conf for complexity requirements that were expected to protect secrets.","fix":"- Upgrade the keystone package to a version containing commit 7859ed26003858ebfd9a5e866b43f1a6a9e83dca (fixed version unknown from the sources).\n- Rotate application secrets that were created or relied on for complexity guarantees.","status":"open","published_at":"2022-08-26T16:15:08+00:00","first_seen_at":"2026-10-27T16:51:11+00:00","triaged_at":"2026-10-27T16:52:26+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:52:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the keystone package to a version containing commit 7859ed26003858ebfd9a5e866b43f1a6a9e83dca (fixed version unknown from the sources).\n- Rotate application secrets that were created or relied on for complexity guarantees.","reach":"network","title":"OpenStack Keystone: application secret checked only for first 72 characters","impact":"high","summary":"OpenStack Keystone, the identity service, verifies only the first 72 characters of an application secret. An attacker can therefore use a secret that matches the first 72 characters and gets past the password complexity rules administrators rely on.","category":"package","nicknames":[],"who_cares":["openstack","keystone","self-hosted","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker bypasses secret checks and reads or changes identity data","analyst_note":"Confirm the fixed Keystone version and whether the 72-character truncation applies to application credentials or only to user passwords, using the GHSA-cc99-whm5-mmq3 advisory and the linked commit.","how_to_check":"- Check the installed keystone version with `pip show keystone` and compare it to the affected range (<= 21.0.0).\n- Review application credential or secret policies in keystone.conf for complexity requirements that were expected to protect secrets.","needs_analyst":true,"not_affected_if":["patched-version","not-using-application-secrets"],"who_is_affected":"Deployments running OpenStack Keystone up to and including 21.0.0 that use application secrets for authentication. Teams not running Keystone, or running a patched release, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000637,"input_tokens":3390,"output_tokens":595,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2021':7A,15A '-3563':8A,16A '-863':37B '/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca)':129C '72':54B,71B,93C 'administr':80B,108C 'allow':101C 'applic':58B,97C 'attack':61B,102C 'author':4A 'avail':131C 'bypass':103C 'cc99':11A 'charact':55B,72B,94C 'complex':78B,106C 'confidenti':122C 'count':111C 'cve':6A,14A 'cwe':36B 'data':121C 'debian':20A,22A 'first':53B,70B,92C 'flaw':83C 'found':85C 'get':74B 'ghsa':10A 'ghsa-cc99-whm5-mmq3':9A 'highest':114C 'host':44B 'ident':48B 'incorrect':3A 'integr':124C 'keyston':2A,38B,46B,89C 'keystone':17A,19A 'linux':21A,23A 'match':68B 'may':109C 'mmq3':13A 'opendev.org':128C 'opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca)':127C 'openstack':1A,18A,25A,28A,31A,34A,39B,45B,88C 'openstack-keyston':87C 'packag':40B 'password':77B,105C 'past':75B 'patch':126C 'platform':26A,29A,32A,35A 'python':41B 'redhat':24A,27A,30A,33A 'reli':81B 'rule':79B 'secret':59B,66B,98C 'self':43B 'self-host':42B 'servic':49B 'therefor':63B 'threat':115C 'use':64B 'verifi':50B,100C 'vulner':5A,118C 'whm5':12A","nicknames":[],"mitigations":[],"who_affected":"Deployments running OpenStack Keystone up to and including 21.0.0 that use application secrets for authentication. Teams not running Keystone, or running a patched release, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-08-26T16:15:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-cc99-whm5-mmq3","url":"https://github.com/advisories/GHSA-cc99-whm5-mmq3","severity":"critical","published_at":"2022-08-27T00:00:44+00:00","modified_at":"2026-10-27T16:49:06+00:00","first_seen_at":"2026-10-27T16:51:11+00:00","fetched_at":"2026-10-27T16:51:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-3563","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3563","severity":null,"published_at":"2022-08-26T16:15:08+00:00","modified_at":"2026-06-17T04:05:21+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}