---
id: "CVE-2026-92450"
kind: "vulnerability"
aliases: ["CVE-2026-92450"]
title: "Kiloview E3 NDI encoder: hardcoded JWT key lets attackers forge admin sessions"
severity: "high"
cvss: 8.7
epss: 0.00366
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Kiloview E3 Firmware", "fixed": ["1.30"], "affected": "< 1.30", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "kiloview", "ndi", "self-hosted", "video-encoder"]
not_affected_if: ["auth-not-jwt", "other-firmware"]
published_at: "2026-10-22T23:20:33+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92450", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:37:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92450", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Kiloview E3 NDI encoder: hardcoded JWT key lets attackers forge admin sessions

Kiloview E3 NDI encoder firmware signs session JSON Web Tokens with an HMAC-SHA256 secret hardcoded in the firmware image, identical on every device. An attacker who downloads the public firmware can recover the secret, forge administrative tokens, and reach privileged device functions without credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kiloview E3 Firmware affected < 1.30 fixed 1.30

## How to check

Open the E3 web UI and read the firmware version under system info; anything below 1.30 is vulnerable. Also check whether the management interface is reachable from untrusted networks.

## Fix

Update E3 firmware to V1.30 (https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/). No workaround listed; restrict management interface to a trusted network until updated.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92450
- 2026-10-23T23:37:28+00:00 analyst — CISA ICSA-26-295-01 + OpenCVE: E3 firmware <1.30 affected, fixed in V1.30; no known exploitation or public PoC per CISA. Kiloview's own advisory page not read; fix link taken from OpenCVE. Part of a nine-CVE batch (siblings 107861, 109122, 110243).
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92450

## Documents

- [advisory] CISA ICSA-26-295-01 Kiloview E3 NDI Encoder https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- [fix] OpenCVE CVE-2026-92450 https://app.opencve.io/cve/CVE-2026-92450

## From the sources

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_