A vulnerability was found in Keystone's list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforcescope is false. Users with a role on a project are able to view any other users' credentials, which could leak sign-on information for Time-based One Time Passwords (TOTP) or othewise. Deployments running keystone with enforcescope set to false are affected. There will be a slight performance impact for the list credentials API once this issue is fixed. Affects: ==15.0.0, ==16.0.0