{"id":"CVE-2026-116747","kind":"vulnerability","aliases":["CVE-2026-116747"],"related":[],"title":"Kener: hardcoded fallback key lets attackers forge admin session cookies","description":"Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.","summary":"Kener 3.0.0 before 4.1.10 falls back to a hardcoded DUMMY_SECRET signing key when KENER_SECRET_KEY is empty or unset. An unauthenticated attacker who knows an administrator's email can sign a kener-user cookie and reach /manage/api with full admin rights, or forge password-reset tokens.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kener","node","package","self-hosted","status-page"],"not_affected_if":["fixed-version","managed-hosting","secret-key-set"],"how_to_check":"- Check whether `KENER_SECRET_KEY` is set and non-empty in the Kener environment (for example in the Docker compose file, `.env`, or the host's environment).\n- Check the installed Kener version: it is affected if it is `3.0.0` up to but not including `4.1.10`.","fix":"- Upgrade Kener to `4.1.10` or later.\n- Set `KENER_SECRET_KEY` to a long random value, and rotate any sessions or reset tokens issued while it was empty.","status":"open","published_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:31+00:00","updated_at":"2026-10-26T22:27:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T22:27:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kener to `4.1.10` or later.\n- Set `KENER_SECRET_KEY` to a long random value, and rotate any sessions or reset tokens issued while it was empty.","reach":"internet","title":"Kener: hardcoded fallback key lets attackers forge admin session cookies","impact":"high","summary":"Kener 3.0.0 before 4.1.10 falls back to a hardcoded DUMMY_SECRET signing key when KENER_SECRET_KEY is empty or unset. An unauthenticated attacker who knows an administrator's email can sign a kener-user cookie and reach /manage/api with full admin rights, or forge password-reset tokens.","category":"package","nicknames":[],"who_cares":["self-hosted","kener","status-page","node"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker gets full administrator access to the status page and its API","analyst_note":"Confirm the fixed version and whether the fallback applies by default in 3.x releases; the NVD entry gives no vendor advisory link.","how_to_check":"- Check whether `KENER_SECRET_KEY` is set and non-empty in the Kener environment (for example in the Docker compose file, `.env`, or the host's environment).\n- Check the installed Kener version: it is affected if it is `3.0.0` up to but not including `4.1.10`.","needs_analyst":true,"not_affected_if":["fixed-version","secret-key-set","managed-hosting"],"who_is_affected":"Deployments running Kener from 3.0.0 up to 4.1.10 where KENER_SECRET_KEY is empty or unset, so the hardcoded DUMMY_SECRET fallback is used for signing. Exposed instances that serve the management interface on a network reachable by attackers are the main concern. Installations on 4.1.10 or later, or with a strong KENER_SECRET_KEY set, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000689,"input_tokens":3368,"output_tokens":704,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116747':13A,16A '-2026':12A,15A '/manage/api':65B,123C '3.0.0':27B,77C '4.1.10':29B,79C 'access':122C 'admin':8A,68B 'administr':53B,112C,126C 'allow':86C 'attack':6A,49B,88C,109C 'authent':82C 'back':31B 'bypass':83C 'contain':80C 'cooki':10A,62B,120C 'cve':11A,14A 'dummi':35B,97C 'email':55B,113C 'empti':44B,106C 'fall':30B 'fallback':3A,99C 'forg':7A,71B,90C,129C 'full':67B,125C 'hardcod':2A,34B,96C 'host':22B 'kener':1A,17B,26B,40B,60B,76C,102C,118C 'kener-us':59B,117C 'key':4A,38B,42B,100C,104C 'know':51B,110C 'let':5A 'node':18B 'packag':19B 'page':25B 'password':73B,131C 'password-reset':72B,130C 'privileg':127C 'reach':64B 'reset':74B,132C 'right':69B 'secret':36B,41B,98C,103C 'self':21B 'self-host':20B 'session':9A,91C 'sign':37B,57B,115C 'status':24B 'status-pag':23B 'token':75B,92C,133C 'unauthent':48B,87C 'unset':46B,108C 'use':94C 'user':61B,119C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Kener from 3.0.0 up to 4.1.10 where KENER_SECRET_KEY is empty or unset, so the hardcoded DUMMY_SECRET fallback is used for signing. Exposed instances that serve the management interface on a network reachable by attackers are the main concern. Installations on 4.1.10 or later, or with a strong KENER_SECRET_KEY set, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116747","severity":null,"published_at":"2026-10-26T22:16:59+00:00","modified_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}