CVE-2026-90460

A flaw was found in OpenStack Keystone. Tokens obtained via delegated authentication methods trusts, application credentials, OAuth1 access tokens can move a credential to an unauthorized project by supplying a new projectid in a PATCH /v3/credentials request, because only the pre-update project ...