CVE-2026-116747: Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMYSECRET fallback key. When KENERSECRETKEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Kener versions from 3.0.0 before 4.1.10 are affected when KENER_SECRET_KEY is empty or unset. Deployments with a configured non-empty KENER_SECRET_KEY are not described as vulnerable through the hardcoded fallback-secret condition.
What does an attacker need to exploit the bypass?
An attacker does not need prior authentication, but needs to know an administrator email address. They can then use the hardcoded DUMMY_SECRET fallback key to sign a kener-user cookie or forge password-reset tokens.
What access can a successful attacker obtain?
A forged kener-user cookie can provide access to /manage/api with full administrative privileges. The issue also permits forgery of password-reset tokens.
What can be done if upgrading is not immediately possible?
Set KENER_SECRET_KEY to a non-empty value to avoid use of the DUMMY_SECRET fallback key. This mitigation directly addresses the vulnerable condition described.