CVE-2026-19505 PUBLISHED

RDK-B WebUI improper cryptographic signature verification vulnerability

Assigner: certcc
Reserved: 10.08.2026 Published: 19.08.2026 Updated: 19.08.2026

Improper cryptographic signature verification in jst_functions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.

Product Status

Vendor RDK
Product RDK-B WebUI
Versions
  • Version rdkb-2025q4-kirkstone is affected

References

Problem Types

  • CWE-347 Improper Verification of Cryptographic Signature