OpenStack Keystone allows information disclosure during account lockingGHSA-4225-97pr-rr52
HIGHFix: openstack/keystone@1b573aeGHSA-4225-97pr-rr52 is a high-severity (CVSS 7.5) CWE-307 vulnerability in keystone. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for keystone — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
keystone🐍keystone🐍keystone🐍keystoneReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | keystone | ≥ 10.0&&< 16.0.2 | 16.0.2pip install --upgrade 'keystone==16.0.2' |
| 🐍PyPI | keystone | ≥ 17.0&&< 17.0.1 | 17.0.1pip install --upgrade 'keystone==17.0.1' |
| 🐍PyPI | keystone | ≥ 18.0&&< 18.0.1 | 18.0.1pip install --upgrade 'keystone==18.0.1' |
| 🐍PyPI | keystone | ≥ 19.0&&< 19.0.1 | 19.0.1pip install --upgrade 'keystone==19.0.1' |
Affected Products
keystoneopenstackResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for keystone, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update keystone to 16.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4225-97pr-rr52 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
Frequently Asked Questions
Is GHSA-4225-97pr-rr52 in your dependencies?
Find it across PyPI, including transitive dependencies.