Cpe:2.3:a:kener:kener:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akenerkener/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 01:51:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKener: Authentication bypass via hardcoded secret (CVE-2026-116747)https://feed.craftedsignal.io/briefs/2026-10-kener-auth-bypass/Tue, 27 Oct 2026 01:51:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kener-auth-bypass/Kener versions 3.0.0 through 4.1.9 contain an authentication bypass vulnerability allowing attackers to forge administrative session tokens using a hardcoded fallback secret.Kener versions 3.0.0 through 4.1.9 are susceptible to an authentication bypass vulnerability. If the 'KENER_SECRET_KEY' environment variable is not explicitly set, the application defaults to a hardcoded 'DUMMY_SECRET' fallback key. An unauthenticated attacker aware of an administrator's email address can use this key to sign 'kener-user' cookies, granting them administrative access to '/manage/api' or enabling the generation of unauthorized password-reset tokens.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative privileges and perform sensitive actions within the Kener management API or hijack account authentication flows.

Recommendation

  • Upgrade Kener to version 4.1.10 or later immediately.
  • If upgrading is not immediately possible, ensure the 'KENER_SECRET_KEY' environment variable is explicitly configured with a cryptographically secure, high-entropy string to prevent the application from falling back to the hardcoded default.
  • Audit logs for the '/manage/api' endpoint for successful requests originating from unexpected IP addresses or associated with suspected forged cookies.
]]>highadvisory