CVE-2026-116747 Details
Description
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
An authentication bypass vulnerability has been identified in Kener versions 3.0.0 prior to 4.1.10. This vulnerability allows unauthenticated attackers to forge session tokens by exploiting a hardcoded fallback key, 'DUMMY_SECRET'. When the 'KENER_SECRET_KEY' environment variable is empty or unset, attackers with knowledge of an administrator's email can create a 'kener-user' cookie. This forged cookie grants access to the '/manage/api' endpoint with full administrative privileges or allows the creation of password-reset tokens.
Users should set the 'KENER_SECRET_KEY' to a strong, random value and upgrade to Kener version 4.1.10, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rajnandan1/kener | [email protected] | ProductVendor |
| https://github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonController.ts#L44-L55 | [email protected] | Source CodeVendor |
| https://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8 | [email protected] | Source CodeVendor |
| https://github.com/rajnandan1/kener/issues/871 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/rajnandan1/kener/releases/tag/v4.1.10 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/kener-3.0.0-before-4.1.10-authentication-bypass-via-hardcoded-fallback-jwt-secret | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kener | >= 3.0.0, < 4.1.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |