Authentication Bypass Vulnerability in Keystone by Red Hat

CVE-2022-2447

What is CVE-2022-2447?

A vulnerability exists in Keystone where a delay, up to one hour in default configurations, occurs between the security policy actions that dictate token revocation and the actual revocation process. This flaw may enable malicious remote administrators to covertly retain access privileges longer than anticipated, potentially leading to unauthorized actions within the system.

References