Zero Radar
← feed
CriticalVulnerabilityCVE-2026-116747updated 26 Oct 2026, 22:19 UTC

Kener forges admin login cookies using a hardcoded key

If the server's secret key is left empty or unset, an outsider can fake a login cookie and take full control of the admin area without a password. They only need to know an administrator's email address.

Fixed in Kener 4.1.10 or laterOfficial source
SeverityCriticalCVSS 9.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesKener 4.1.10 or later · since 26 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerKnows an admin email address
  2. 2Hardcoded keyUses the built-in DUMMY_SECRET fallback
  3. 3Forged cookieSigns a kener-user session cookie
  4. 4Admin APIServer accepts the cookie at /manage/api
  5. 5Full admin accessCan also forge password-reset tokens
  6. ResultAttacker gains full administrative control

What happened

Kener versions 3.0.0 before 4.1.10 fall back to a hardcoded DUMMY_SECRET key to sign session cookies when KENER_SECRET_KEY is empty or unset. Attackers can sign their own kener-user cookie with that key to authenticate to /manage/api.

Why it is dangerous: An attacker can gain full administrative privileges or forge password-reset tokens, which means they can take over the site and any accounts tied to it. Anyone running an affected Kener instance without a configured secret key is exposed.

Are you affected?

You are affected if you run Kener 3.0.0 up to (but not including) 4.1.10 and KENER_SECRET_KEY is empty or unset.

Kener 3.0.0 before 4.1.10, when KENER_SECRET_KEY is empty or unset

What to do

  1. Update Kener to version 4.1.10 or later
  2. Set KENER_SECRET_KEY to a long, random value, even if you are not yet updating
  3. Check admin accounts and active sessions for signs of unexpected access

Timeline

  1. 26 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 22:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 22:19 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116747
CVSS
9.2 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 22:16 UTC
On Zero Radar
26 Oct 2026, 22:19 UTC (3 min after disclosure)
Last change
26 Oct 2026, 22:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Kener forges admin login cookies using a hardcoded key · Zero Radar