CVE-2014-0204

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.

• CWE-269

• http://www.openwall.com/lists/oss-security/2014/05/21/3Mailing List, Patch, Third Party Advisory
• https://bugs.launchpad.net/keystone/+bug/1309228Exploit, Issue Tracking, Third Party Advisory
• https://review.openstack.org/#/c/94396/Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/05/21/3Mailing List, Patch, Third Party Advisory
• https://bugs.launchpad.net/keystone/+bug/1309228Exploit, Issue Tracking, Third Party Advisory
• https://review.openstack.org/#/c/94396/Patch, Third Party Advisory

Published

Nov 3, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0198The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x throug…
• CVE-2014-0199The setup script in ovirt-engine-reports, as used in the Red…
• CVE-2014-0200The Red Hat Enterprise Virtualization Manager reports (rhevm…
• CVE-2014-0201ovirt-engine-reports, as used in the Red Hat Enterprise Virt…
• CVE-2014-0202The setup script in ovirt-engine-dwh, as used in the Red Hat…
• CVE-2014-0203The __do_follow_link function in fs/namei.c in the Linux ker…5.5
• CVE-2014-0205The futex_wait function in kernel/futex.c in the Linux kerne…
• CVE-2014-0206Array index error in the aio_read_events_ring function in fs…
• CVE-2014-0207The cdf_read_short_sector function in cdf.c in file before 5…6.5
• CVE-2014-0208Cross-site scripting (XSS) vulnerability in the search auto-…
• CVE-2014-0209Multiple integer overflows in the (1) FontFileAddEntry and (…
• CVE-2014-0210Multiple buffer overflows in X.Org libXfont before 1.4.8 and…