Authentication bypass in Kener via hardcoded fallback JWT secret
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.
Summary
Kener 3.0.0 before 4.1.10 contains an authentication bypass that lets unauthenticated attackers forge session tokens. The flaw is a hardcoded fallback signing key (CWE-321), DUMMY_SECRET, used when KENER_SECRET_KEY is empty or unset, which lets attackers sign tokens. An attacker who knows an administrator email can forge a kener-user cookie and gain full administrative access to /manage/api, or forge password-reset tokens.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rajnandan1 | kener | 3.0.0 to before 4.1.10 | 4.1.10 | Patch available | CNA |
- kener Vendorrajnandan1 Affected 3.0.0 to before 4.1.10 Fixed in 4.1.10 Patch available CNA
Remediation
Upgrade rajnandan1 Kener to version 4.1.10 or later, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA kener (rajnandan1) Fixed in 4.1.10
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116747
- 2026-10-27 Alias added: GHSA-7973-f655-53vh
- 2026-11-05 EPSS moved to the 50th–90th percentile
- 2026-11-05 CISA SSVC decision points changed
References
More rajnandan1 vulnerabilities
- TI-2026-67392 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-116747 · CVE Program
- CVE-2026-116747 · NVD
- FIRST EPSS
- GHSA-7973-f655-53vh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences