CVE-2026-96616
Kiloview E3 NDI Encoder Insufficient Session Expiration
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The affected software is the web management interface of the Kiloview E3 NDI encoder, a video encoding device. Because its login authentication tokens do not expire within a reasonable time, a token that is intercepted or obtained through device compromise can be used to gain authenticated access to the device for an extended period.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
Affected versions
- Kiloview E3 Firmware
fixed in 1.30