CVE-2026-116747

Name of the Vulnerable Software and Affected Versions Kener versions 3.0.0 through 4.1.9

Description An authentication bypass exists when the KENER SECRET KEY is empty or unset, causing the system to use a hardcoded DUMMY SECRET fallback key. This allows unauthenticated attackers who know an administrator email to forge session tokens via the kener-user cookie to gain full administrative access to the '/manage/api' endpoint or forge password-reset tokens.

Recommendations Update to version 4.1.10.