CVE-2026-43002

Name of the Vulnerable Software and Affected Versions OpenStack Horizon versions 25.6 through 25.7.2 OpenStack Horizon versions 25.7 through 25.7.2

Description A write operation occurs in the session storage backend before authentication, allowing unauthenticated requests to exhaust the storage. Specifically, the login view stores a post-login redirect URL in the server-side session before the user is authenticated, which can be exploited to cause a session flood.

Recommendations Update to version 25.7.3.