Threats tagged 'ghsa-7973-f655-53vh'

Kener versions from 3.0.0 up to but not including 4.1.10 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to forge session tokens by exploiting a hardcoded fallback key (DUMMY_SECRET) used when the KENER_SECRET_KEY is unset or empty. Attackers who know an administrator's email can sign a user cookie to gain full administrative access to the management API or forge password-reset tokens.