CVE-2025-13476 PUBLISHED

Rakuten Viber uses broken or risky cryptographic Algorithm

Assigner: certcc
Reserved: 20.11.2025 Published: 05.03.2026 Updated: 06.03.2026

Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)

Product Status

Vendor Rakuten Viber
Product Rakuten Viber Cloak - Android
Versions
  • affected from 25.7.2.0g to 27.2.0.0g (excl.)
Vendor Rakuten Viber
Product Rakuten Viber Cloak - Windows
Versions
  • affected from v25.6.0.0 to v27.3.0.0 (excl.)

References

Problem Types

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm
  • CWE-693