Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Kener lets attackers forge admin session tokens

CVE-2026-116747 · published 1 day ago
Summary

The Kener software versions before 4.1.10 use a built‑in secret key when no custom key is set. Because of this, anyone who knows an admin email can create a valid login cookie and gain full administrative access or reset passwords. Set a unique secret key for Kener or upgrade to version 4.1.10 or later to stop the risk.

What to do
  • Update rajnandan1 kener to version 4.1.10 or later.
Affected software
VendorProductAffected versions
rajnandan1 kener < 4.1.10
Original advisory text
Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Sources
CVE-2026-116747 · NVD
CVE-2026-116747 · MITRE
CVE-2026-116747 · OSV
Track software like this
Free during beta