Authentication Bypass in Kener 3.0.0 by Hardcoded Fallback Key
CVE-2026-116747

9.2CRITICAL

Key Information:

Vendor

Rajnandan1

Status
Kener
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116747?

Kener versions prior to 4.1.10 are susceptible to an authentication bypass due to a flaw arising from the utilization of a hardcoded fallback key, termed DUMMY_SECRET. If the KENER_SECRET_KEY is left empty or unset, it enables unauthenticated attackers to forge session tokens. This could lead to unauthorized access to administrative functionalities via the /manage/api endpoint or manipulation of password-reset tokens, thereby compromising the security of the application.

Affected Version(s)

kener 3.0.0 < 4.1.10

References

https://github.com/rajnandan1/kener/issues/871
issue-tracking
https://github.com/rajnandan1/kener
product
https://github.com/rajnandan1/kener/commit/ff636483544c92...
patch

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.