What is CVE-2026-116747?

CVE-2026-116747 is a high-severity vulnerability in Rajnandan1 Kener, classified under Use of Hard-coded Cryptographic Key. CVSS score: 8.1/10. Published 2026-10-26.

How severe is CVE-2026-116747?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Rajnandan1 Kener

CVE-2026-116747

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

Published 2026-10-26.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Rajnandan1 Kener

Weakness classification (CWE)

CWE-321 — Use of Hard-coded Cryptographic Key

References

github.com/rajnandan1/kener/issues/871 (issue-tracking)
github.com/rajnandan1/kener (product)
github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8 (patch)
github.com/rajnandan1/kener/releases/tag/v4.1.10 (release-notes)
github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonContro… (technical-description)
www.vulncheck.com/advisories/kener-3.0.0-before-4.1.10-authentication-bypass-vi… (third-party-advisory)

Frequently asked questions

What is CVE-2026-116747?: CVE-2026-116747 is a high-severity vulnerability in Rajnandan1 Kener, classified under Use of Hard-coded Cryptographic Key. CVSS score: 8.1/10. Published 2026-10-26.
How severe is CVE-2026-116747?: High severity. CVSS v3 base score is 8.1 out of 10.