Authenticated administrator impersonation via credential reassignment

Incorrect authorization in OpenStack Keystone before 15.0.1 and in 16.0.0 allows remote authenticated users to gain administrator access. The EC2 credential update endpoint accepts changes to a regular user's credential owner and project without checking that the updated credential remains owned by that user. Any authenticated user with a role on one project can retarget a self-created credential to another user and project, then assume that user's privileges, including global administrator access when the victim has an administrative role.