NVD security advisory
Security advisory for Kener 3.0.0
CVE-2026-116747
Full advisory details, affected packages, severity context, and original source.
Affected technology
Kener 3.0.0Affected product
Advisory overview
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
Related references
- https://github.com/rajnandan1/kener
- https://github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonController.ts#L44-L55
- https://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8
- https://github.com/rajnandan1/kener/issues/871
- https://github.com/rajnandan1/kener/releases/tag/v4.1.10
- https://www.vulncheck.com/advisories/kener-3.0.0-before-4.1.10-authentication-bypass-via-hardcoded-fallback-jwt-secret