CRITICAL 9.2 NVD
CVE-2026-116747
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded D
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
References
- https://github.com/rajnandan1/kener
- https://github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonControlle
- https://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8
- https://github.com/rajnandan1/kener/issues/871
- https://github.com/rajnandan1/kener/releases/tag/v4.1.10
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-26 via NVD.
Risk Timeline
CVE Disclosed2026-10-26 · -1 days ago
Remediation Resources
vulnfeed aggregates 18455 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.