Kener CVE-2026-116747

The decisive prerequisite is that the target Kener instance runs with the KENER_SECRET_KEY environment variable empty or unset, which activates the hardcoded 'DUMMY_SECRET' fallback used to sign and verify the kener-user JWT session cookie, password-reset tokens, and API-key HMACs. The attacker must also know (or correctly guess) an administrator's email address to populate the forged token's claims. The vulnerability affects Kener 3.0.0 through versions before 4.1.10. Principal limiting factor: any instance that has set a strong, unique KENER_SECRET_KEY is not exploitable, because the forged token will fail verification against the real key - this is the AT:P attack requirement in the 4.0 vector. No user interaction and no authentication are required against a misconfigured instance (PR:N/UI:N), and the admin management surface is reached over the network (/manage/api).

Signals conflict in an instructive way. The CVSS 4.0 base score is 9.2 (critical) with AV:N/AC:L/PR:N/UI:N and full VC:H/VI:H/VA:H impact, and the vuln.today decision label is act_now, which argues for urgent remediation. However, the 4.0 vector itself carries AT:P (an attack requirement), reflecting that exploitation is gated on a specific condition: the instance must be running with KENER_SECRET_KEY empty or unset so the hardcoded DUMMY_SECRET fallback is active. EPSS is only 0.62% (50th percentile), i.e. middling-to-low predicted exploitation, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. There is no public exploit identified at time of analysis, though the vendor patch (and its regression test) openly demonstrates the forging technique (jwt.sign of an admin claim with 'DUMMY_SECRET'), making the mechanism trivially reconstructible for any attacker who reads the fix. Net: for instances actually left on the fallback secret this is a genuine, high-priority unauthenticated full-admin compromise and the act_now label is justified; for correctly configured instances (a strong KENER_SECRET_KEY set) it is not exploitable at all. The low EPSS likely reflects both the small deployment footprint and the configuration dependency rather than low impact.

An attacker locates an internet-exposed Kener instance (versions 3.0.0 up to but not including 4.1.10) that is running with KENER_SECRET_KEY empty or unset, so the DUMMY_SECRET fallback is in use. Knowing or guessing an administrator's email, the attacker signs a kener-user JWT cookie with 'DUMMY_SECRET' and presents it to /manage/api to obtain full administrative privileges, or forges a password-reset token for that account. No public exploit is identified at time of analysis, but the vendor's own patch test shows the one-line forging method, so the barrier to reproduction is minimal given AV:N/AC:L.