Kener
Monthly
Authentication bypass in Kener 3.0.0 through 4.1.9 lets unauthenticated remote attackers who know an administrator's email address forge a kener-user JWT session cookie and reach /manage/api with full administrative privileges, and also forge password-reset tokens, because the application silently falls back to the hardcoded string 'DUMMY_SECRET' when KENER_SECRET_KEY is empty or unset. The flaw is conditional rather than universal: the assessed vector is AC:H/AT:P precisely because any instance configured with a strong, unique KENER_SECRET_KEY rejects the forged token, so only default or misconfigured deployments are exploitable - but those deployments are fully compromised with no credentials and no user interaction. No public exploit code is confirmed at time of analysis and there is no KEV listing; EPSS is 0.62% (50th percentile), which understates the risk for unhardened instances, and the vendor priority label is act_now.
Authentication bypass in Kener 3.0.0 through 4.1.9 lets unauthenticated remote attackers who know an administrator's email address forge a kener-user JWT session cookie and reach /manage/api with full administrative privileges, and also forge password-reset tokens, because the application silently falls back to the hardcoded string 'DUMMY_SECRET' when KENER_SECRET_KEY is empty or unset. The flaw is conditional rather than universal: the assessed vector is AC:H/AT:P precisely because any instance configured with a strong, unique KENER_SECRET_KEY rejects the forged token, so only default or misconfigured deployments are exploitable - but those deployments are fully compromised with no credentials and no user interaction. No public exploit code is confirmed at time of analysis and there is no KEV listing; EPSS is 0.62% (50th percentile), which understates the risk for unhardened instances, and the vendor priority label is act_now.