# KeystoneJS keystone authentication weakness in email matching

Source: https://junglewise.ai/threats/keystonejs-keystone-authentication-weakness-in-email-matching-6ecf46db  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-08-19

KeystoneJS Keystone is a popular Node.js framework for building content management systems and backend APIs. A bug in the default sign-in functionality allows attackers to authenticate using incomplete or partial email addresses, provided they know the correct password. This could enable account takeover if an attacker can guess or brute-force a partial email address combined with a weak password.

Technologies: [keystone (npm)](https://junglewise.ai/threats/technologies/npm-keystone). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 19 August 2020.

**Which products and versions are affected?** keystone (npm) SEMVER:introduced=0,fixed=0.3.16.

**Is there a fix for This vulnerability?** Yes. keystone (npm): upgrade to 0.3.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run keystone (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- keystone (npm): upgrade to 0.3.16 or later

  ```sh
  npm install keystone@0.3.16
  ```


## Technical details

The vulnerability is an authentication weakness in Keystone's default sign-in logic that performs incomplete email address validation. The bug allows email matching on partial strings rather than exact matches, meaning a user account with email "user@example.com" could be logged into using "user@" or similar incomplete variants. A correct password is still required, so this is not a complete authentication bypass. The issue affects all versions prior to 0.3.16. The attack vector is network-based and requires no special privileges, though the attacker must know or guess both a valid partial email and the correct password.

## Affected products

- KeystoneJS keystone before 0.3.16

## Timeline

- 2020-08-19: disclosed
- 2019-05-29: patched: Fixed in version 0.3.16

## References

- [https://github.com/keystonejs/keystone/issues/1085](https://github.com/keystonejs/keystone/issues/1085)

## Related threats

- [Keystone cross-site scripting](https://junglewise.ai/threats/keystone-cross-site-scripting-9990301e)
- [Keystone Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2017-16570-keystone-cross-site-request-forgery-csrf)
- [KeystoneJS cross-site scripting in blog posts](https://junglewise.ai/threats/cve-2017-15881-keystonejs-cross-site-scripting-in-blog-posts)
- [KeystoneJS CSV injection in export](https://junglewise.ai/threats/cve-2017-15879-keystonejs-csv-injection-in-export)
- [KeystoneJS Cross-Site Scripting in contact form](https://junglewise.ai/threats/cve-2017-15878-keystonejs-cross-site-scripting-in-contact-form)