Kener: Authentication bypass via hardcoded secret (CVE-2026-116747)

Kener versions 3.0.0 through 4.1.9 are susceptible to an authentication bypass vulnerability. If the 'KENER_SECRET_KEY' environment variable is not explicitly set, the application defaults to a hardcoded 'DUMMY_SECRET' fallback key. An unauthenticated attacker aware of an administrator's email address can use this key to sign 'kener-user' cookies, granting them administrative access to '/manage/api' or enabling the generation of unauthorized password-reset tokens.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative privileges and perform sensitive actions within the Kener management API or hijack account authentication flows.

Recommendation

• Upgrade Kener to version 4.1.10 or later immediately.
• If upgrading is not immediately possible, ensure the 'KENER_SECRET_KEY' environment variable is explicitly configured with a cryptographically secure, high-entropy string to prevent the application from falling back to the hardcoded default.
• Audit logs for the '/manage/api' endpoint for successful requests originating from unexpected IP addresses or associated with suspected forged cookies.