CVE-2026-19505: RDK-B WebUI improper cryptographic signature verification vulnerability
Published Aug 19, 2026
·Updated
Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.
Affected Software
1 affected component
RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26=rdkb-2025q4-kirkstone.04.10.26
Event History
Aug 19, 2026
CVE Published
via MITRE·07:27 PM
Data Sourced
via MITRE·07:27 PM
DescriptionWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs remote access to the affected RDK-B WebUI. Exploitation involves presenting a forged JWT with an invalid RSA signature to bypass authentication and gain administrative access.
2
Which software version is identified as affected?
The affected software identified in the available data is RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26.