Live › vulnerability › CVE-2026-92450
Go to dashboardKiloview E3 NDI encoder firmware signs session JSON Web Tokens with an HMAC-SHA256 secret hardcoded in the firmware image, identical on every device. An attacker who downloads the public firmware can recover the secret, forge administrative tokens, and reach privileged device functions without credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Kiloview E3 Firmware | vendor | < 1.30 | 1.30 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.
This page as .md · .json · in your agent: get_signal("CVE-2026-92450")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.