CVE-2026-96616: Kiloview E3 NDI Encoder Insufficient Session Expiration
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiloview E3 NDI Encoderto a version that resolves this vulnerability.Fixed in V1.30
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to obtain a valid authentication token, such as by intercepting it or compromising the device. No additional login is indicated once the token has been obtained.
Who is exposed to the risk?
Organizations operating a Kiloview E3 NDI Encoder and using its web management interface are exposed if an attacker can obtain an issued authentication token. The token can remain usable for authenticated access for an extended period.
How can I tell whether previously exposed credentials may still be usable?
Any authentication token that may have been intercepted or obtained during a device compromise should be treated as potentially still valid, because tokens are effectively non-expiring. The provided information does not specify a token-revocation or session-invalidation method.