CVE-2026-19505

CRITICAL 9.8CVE-2026-19505 · Published 19/08/2026 · updated 03/09/2026

In short

CVE-2026-19505 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.51%, higher than 43.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.

References

developer.rdkcentral.com/documentation/documentation/rdk_broadband_documentation/components/webui
whitehats.pwr.edu.pl//blog/2026-08-19-multiple-vulnerabilities-in-rdkb

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free