CVE-2026-44394

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

• CWE-863

• https://bugs.launchpad.net/keystone/+bug/2150379Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2026-015.htmlPatch, Vendor Advisory

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44383Multiple connections to the backend using the same charging …8.7
• CVE-2026-44387ELECOM wireless LAN routers and access points devices contai…5.2
• CVE-2026-4439Out of bounds memory access in WebGL in Google Chrome on And…8.8
• CVE-2026-44390NLnet Labs Unbound up to and including version 1.25.0 has a …5.3
• CVE-2026-44392Missing authorization vulnerability exists in Movable Type. …5.3
• CVE-2026-44393An issue was discovered in OpenStack oslo.messaging 1.0.0 th…7.4
• CVE-2026-4440Out of bounds read and write in WebGL in Google Chrome prior…8.8
• CVE-2026-44400MailEnable Enterprise Premium 10.55 and earlier contains an …9.8
• CVE-2026-44401Typemill CMS version 2.x contains a persistent cross-site sc…4.8
• CVE-2026-44403Wing FTP Server before 8.1.3 contains an authenticated remot…8.6
• CVE-2026-44405In Paramiko through 4.0.0 before a448945, rsakey.py allows t…3.4
• CVE-2026-44406ZTE Cloud PC client uSmartView contains a DLL hijacking vuln…7.8