Vulnerability intelligence

CVE-2026-19505

RDK RDK-B WebUI

Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

0.4%

Riskier than 33% of all CVEs · checked 2026-09-29

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories