Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

Summary

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

Remediation

1. Inventory every rajnandan1 kener deployment, including staging.
2. Upgrade rajnandan1 kener to 4.1.10.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8
• Advisoryhttps://www.vulncheck.com/advisories/kener-3.0.0-before-4.1.10-authentication-bypass-via-hardcoded-fallback-jwt-secret
• Referencehttps://github.com/rajnandan1/kener
• Referencehttps://github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonController.ts#L44-L55
• Referencehttps://github.com/rajnandan1/kener/issues/871
• Referencehttps://github.com/rajnandan1/kener/releases/tag/v4.1.10