CVE-2026-116747 Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

Critical 9.2 Published 26 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116747?

CVE-2026-116747 is a critical vulnerability in rajnandan1 kener, published on 26 Oct 2026.

Official description

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

Weakness: CWE-321

Which versions are affected by CVE-2026-116747?

How do I fix CVE-2026-116747?

No fix has been published for CVE-2026-116747 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116747 being exploited?

There is no known exploitation of CVE-2026-116747 in the wild and no public exploit code.

Sources

Also known as GHSA-7973-f655-53vh.