CVE-2015-9240
Authentication Weakness in keystone
CVE-2015-9240 is a high vulnerability (CVSS 7.5) in Hackerone Keystone Node Module, published May 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 59th percentile. Fixed in keystone 0.3.16.
- Severity
- 7.5 HighCVSS 3.0, NVD
- Exploit chance
- 0.86%EPSS, 59th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.3.16keystone
Description
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonenpm | before 0.3.16 | 0.3.16 |
What each source reports
NVD Score used
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
- Record
CVE-2015-9240- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE ListNo score
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
- Record
CVE-2015-9240- Updated
- 2026-11-02
EUVDEUVD-2018-0194No score
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
- Record
EUVD-2018-0194- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-39pj-gq8q-9pfj
Authentication Weakness in keystone
Versions of keystone prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted.
Recommendation
Update to version 0.3.16 or later.
- Record
GHSA-39pj-gq8q-9pfj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1255
- Updated
- 2026-11-02
OSVGHSA-39pj-gq8q-9pfj
Authentication Weakness in keystone
Versions of keystone prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted.
Recommendation
Update to version 0.3.16 or later.
- Record
GHSA-39pj-gq8q-9pfj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1255
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.