CVE-2026-116747

HighCVSS 8.1

Published: 26/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.62%

50th percentile - higher than 50% of all known CVEs

Summary

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability. When KENER_SECRET_KEY is empty or unset, attackers can forge session tokens using the hardcoded DUMMY_SECRET fallback key, and knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

Risk Assessment

Unauthenticated attackers can gain full administrative control over the Kener application, risking data and configuration tampering and further escalation. The risk is especially high in deployments where KENER_SECRET_KEY is not set.

Recommendation

Upgrade Kener to version 4.1.10 or later and ensure KENER_SECRET_KEY is set to a strong, unique value. Review logs for suspicious requests to /manage/api.

Other vulnerabilities in Kener

CVE-2026-105030Medium
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.

Original NVD description (English source)

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS