CVE-2026-92450

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-924546.1The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncatCVE-2026-924554.3yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authentiCVE-2026-924567.1yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any CVE-2026-924576.5yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authentCVE-2026-924584.3yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticateCVE-2026-924596.5yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenCVE-2026-92464.3Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault reaCVE-2026-924606.5yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-oCVE-2026-924614.3yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any loCVE-2026-924626.5yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated bCVE-2026-924636.5yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotationCVE-2026-924649.1Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the
CVE-2026-92450: High severity, CVSS 7.5 | Vulnix