Kener 3.0.0 through 4.1.9 contains a flaw that permits any unauthenticated attacker to forge valid session tokens. When the configuration key is omitted, the application falls back to a hard‑coded DUMMY_SECRET. By signing a JWT with this known key and embedding an administrator’s email, an attacker can request /manage/api and gain full administrative privileges. The same technique can be used to generate password‑reset tokens, bypassing all identity checks. The weakness originates from using a hard‑coded secret for JWT signing, a classic authentication bypass and privilege escalation scenario mapped to CWE‑321.

The vulnerability is present in the open‑source project Kener, a Node.js application maintained by the user rajnandan1. Versions from 3.0.0 up to but not including 4.1.10 are affected. The patched release is version 4.1.10, which removes the hard‑coded fallback and enforces the presence of a valid KENER_SECRET_KEY.

The CVSS score of 9.2 identifies this flaw as Critical, with high exploitation potential. The EPSS result is not available, but the simplicity of the exploit – forging a JWT with a known key – suggests that it could be automated by attackers. The vulnerability is not yet listed in CISA’s KEV catalog, yet the exposure of administrative APIs via a predictable secret makes the risk significant if the application is exposed to the internet. Attackers would need the administrator email to craft the token, but such information is easily discoverable. In practice, the impact ranges from unauthorized configuration changes to full takeover of the host if the application runs with elevated privileges.