---
id: "CVE-2021-3563"
kind: "vulnerability"
aliases: ["CVE-2021-3563", "GHSA-cc99-whm5-mmq3"]
title: "Openstack Keystone Incorrect Authorization vulnerability"
severity: "critical"
cvss: 9.1
epss: 0.01863
exploited: false
status: "open"
category: "package"
products: [{"name": "keystone", "fixed": [], "affected": "<= 21.0.0", "ecosystem": "pypi"}, {"name": "openstack keystone", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "redhat openstack platform", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "redhat openstack platform", "fixed": [], "affected": "= 13.0", "ecosystem": "vendor"}, {"name": "redhat openstack platform", "fixed": [], "affected": "= 16.1", "ecosystem": "vendor"}, {"name": "redhat openstack platform", "fixed": [], "affected": "= 16.2", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-863", "keystone", "openstack", "package", "python", "self-hosted"]
not_affected_if: ["not-using-application-secrets", "patched-version"]
published_at: "2022-08-26T16:15:08+00:00"
first_seen_at: "2026-10-27T16:51:11+00:00"
updated_at: "2026-10-27T17:03:04+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-cc99-whm5-mmq3", "first_seen_at": "2026-10-27T16:51:11+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3563", "first_seen_at": "2026-10-27T17:03:04+00:00"}]
---

# Openstack Keystone Incorrect Authorization vulnerability

OpenStack Keystone, the identity service, verifies only the first 72 characters of an application secret. An attacker can therefore use a secret that matches the first 72 characters and gets past the password complexity rules administrators rely on.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:keystone affected <= 21.0.0 fixed ?
- vendor:openstack keystone affected ? fixed ?
- vendor:debian linux affected = 10.0 fixed ?
- vendor:debian linux affected = 11.0 fixed ?
- vendor:redhat openstack platform affected = 10.0 fixed ?
- vendor:redhat openstack platform affected = 13.0 fixed ?
- vendor:redhat openstack platform affected = 16.1 fixed ?
- vendor:redhat openstack platform affected = 16.2 fixed ?

## How to check

- Check the installed keystone version with `pip show keystone` and compare it to the affected range (<= 21.0.0).
- Review application credential or secret policies in keystone.conf for complexity requirements that were expected to protect secrets.

## Fix

- Upgrade the keystone package to a version containing commit 7859ed26003858ebfd9a5e866b43f1a6a9e83dca (fixed version unknown from the sources).
- Rotate application secrets that were created or relied on for complexity guarantees.

## Timeline

- 2026-10-27T16:51:11+00:00 ghsa https://github.com/advisories/GHSA-cc99-whm5-mmq3
- 2026-10-27T17:03:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-3563

## From the sources

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_