Kener: Authentication bypass via hardcoded fallback secret
Summary
Kener, an open-source status page application, uses a hardcoded fallback key (DUMMY_SECRET) to sign and verify session tokens when KENER_SECRET_KEY is empty or unset. An unauthenticated attacker who knows an administrator's email address can forge a session cookie to access the management API with full administrative privileges, or forge password-reset tokens. The attack requires that the secret key is not configured.
Affected
- Kener 3.0.0 up to but not including 4.1.10
- Docker images rajnandan1/kener 3.x and 4.0.x to 4.1.9 (including alpine variants)
Fixed in
- Fixed in Kener 4.1.10 (upstream release v4.1.10, changelog: drop the hardcoded fallback secret and warn on example secrets)
Workaround
- Set KENER_SECRET_KEY to a long, unique random value so the fallback key is never used (vendor-documented mitigation not verified)
- Restrict access to the management area and /manage/api at the reverse proxy or firewall (own recommendation, not a vendor statement)
Exploitation
- Not listed as known exploited; no CISA KEV entry found
- No public proof of concept found
- A Nuclei template pull request for this CVE was opened on 27 Oct 2026, so scanning activity is plausible
Our recommendation
- Check whether any internet-facing Kener instance runs version 3.x or 4.0.x to 4.1.9
- Upgrade to Kener 4.1.10 or later as a priority
- Set KENER_SECRET_KEY to a strong random value and verify it is not empty
- Rotate the secret after upgrading, since forged sessions may already exist
- Review administrator accounts and recent password resets
- Restrict access to the admin area where possible and monitor for unusual access to /manage/api
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kener v4.1.10 release github.com
- Kener issue #871 github.com
- Fix commit ff63648 github.com
- VulnCheck advisory www.vulncheck.com
- Vulnerable code at v4.1.9 github.com
- Kener GitHub repository github.com
- VulDB CVE-2026-116747 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:01.
Original description (NVD)
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
NVD references (6)
- https://github.com/rajnandan1/kener
- https://github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonController.ts#L44-L55
- https://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8
- https://github.com/rajnandan1/kener/issues/871
- https://github.com/rajnandan1/kener/releases/tag/v4.1.10
- https://www.vulncheck.com/advisories/kener-3.0.0-before-4.1.10-authentication-bypass-via-hardcoded-fallback-j…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.