CVE-2012-3426

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.

• CWE-264

• http://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa
• http://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355Patch
• http://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626Exploit, Patch
• http://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d
• http://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454
• http://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56deExploit, Patch
• http://secunia.com/advisories/50045
• http://secunia.com/advisories/50494
• http://www.openwall.com/lists/oss-security/2012/07/27/4Patch
• http://www.ubuntu.com/usn/USN-1552-1
• https://bugs.launchpad.net/keystone/+bug/996595
• https://bugs.launchpad.net/keystone/+bug/997194
• https://bugs.launchpad.net/keystone/+bug/998185
• https://launchpad.net/keystone/essex/2012.1.1/+download/keystone-2012.1.1.tar.gzPatch
• http://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa
• http://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355Patch
• http://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626Exploit, Patch
• http://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d
• http://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454
• http://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56deExploit, Patch
• http://secunia.com/advisories/50045
• http://secunia.com/advisories/50494
• http://www.openwall.com/lists/oss-security/2012/07/27/4Patch
• http://www.ubuntu.com/usn/USN-1552-1
• https://bugs.launchpad.net/keystone/+bug/996595
• https://bugs.launchpad.net/keystone/+bug/997194
• https://bugs.launchpad.net/keystone/+bug/998185
• https://launchpad.net/keystone/essex/2012.1.1/+download/keystone-2012.1.1.tar.gzPatch

Published

Jul 31, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3420Multiple memory leaks in Performance Co-Pilot (PCP) before 3…
• CVE-2012-3421The pduread function in pdu.c in libpcp in Performance Co-Pi…
• CVE-2012-3422The getFirstInTableInstance function in the IcedTea-Web plug…
• CVE-2012-3423The IcedTea-Web plugin before 1.2.1 does not properly handle…
• CVE-2012-3424The decode_credentials method in actionpack/lib/action_contr…
• CVE-2012-3425The png_push_read_zTXt function in pngpread.c in libpng 1.0.…
• CVE-2012-3427EC2 Amazon Machine Image (AMI) in JBoss Enterprise Applicati…
• CVE-2012-3428The IronJacamar container before 1.0.12.Final for JBoss Appl…
• CVE-2012-3429The dns_to_ldap_dn_escape function in src/ldap_convert.c in …
• CVE-2012-3430The rds_recvmsg function in net/rds/recv.c in the Linux kern…
• CVE-2012-3431The Teiid Java Database Connectivity (JDBC) socket, as used …
• CVE-2012-3432The handle_mmio function in arch/x86/hvm/io.c in the MMIO op…