CVE-2026-19505

Name of the Vulnerable Software and Affected Versions RDK-B WebUI version rdkb-2025q4-kirkstone

Description Improper cryptographic signature verification in the jst functions.c file allows a remote, unauthenticated attacker to bypass authentication and obtain administrative access. The issue occurs because the code incorrectly handles the return value of the EVP VerifyFinal() function from OpenSSL, treating both valid and invalid signatures as successful. This allows an attacker to use a forged JSON Web Token (JWT) with an arbitrary RSA signature to log in as a privileged user. Additionally, other flaws involving race conditions, insufficient input validation, and improper authentication may lead to denial-of-service or memory corruption, which could potentially be used for arbitrary code execution on RDK-B processes.

Recommendations Update RDK-B WebUI version rdkb-2025q4-kirkstone to the latest release. Restrict network access to the WebUI interface to trusted management networks only. Monitor authentication logs for anomalous JWT usage from unexpected sources.