Via vendor sec (please note the embargo, don't leak anything):

------------------------------------------------------------------------
This is an advance warning of a vulnerability discovered in OpenStack,
to give you, as downstream stakeholders, a chance to coordinate the
release of fixes and reduce the vulnerability window. Please treat the
following information as confidential until the proposed public
disclosure date.

Title: Keystone tokens not immediately invalidated when user is deleted
Reporter: Sam Stoelinga
Products: Keystone
Affects: Folsom, Grizzly

Description:
Sam Stoelinga reported a vulnerability in Keystone. When users are
deleted through Keystone v2 API, existing tokens for those users are not
immediately invalidated and remain valid for the duration of the token's
life (by default, up to 24 hours). This may result in users retaining
access when the administrator of the system thought them disabled. You
can workaround this issue by disabling a user before deleting it: in
that case the tokens belonging to the disabled user are immediately
invalidated. Keystone setups using the v3 API call to delete users are
unaffected.

Proposed patches:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to Keystone master (havana), stable/grizzly, and
stable/folsom branches on the public disclosure date.

CVE:
No CVE has been assigned to this issue yet.

Proposed public disclosure date/time: Thursday, May 9, 1500UTC. The
notice is relatively short but this is actually not really "exploitable"
and benefits from being documented ASAP... Let me know if you would
rather like to extend it. In all cases, please do not make the issue
public (or release public patches) before this coordinated embargo date.

Regards,

-- 
Thierry Carrez (ttx)
OpenStack Vulnerability Management Team
------------------------------------------------------------------------