CVE-2026-19505 in WebUI
Summary
by MITRE • 08/19/2026
Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified as improper cryptographic signature verification in the RDK-B WebUI component represents a critical failure in the implementation of JSON Web Token (JWT) validation mechanisms within the specified firmware version rdkb-2025q4-kirkstone.04.10.26. This flaw resides specifically within the jst_functions.c source file, which handles JavaScript-related functions for the web interface. The core technical deficiency lies in the application's failure to rigorously validate the cryptographic signature attached to incoming JWTs before processing them as authenticated requests. In a secure implementation, every token presented by a client must be verified against the server's public key or shared secret using the algorithm specified in the token header. However, due to this improper verification logic, the system accepts tokens that possess invalid, malformed, or entirely forged RSA signatures. This indicates that the code likely contains a conditional check that returns true for signature validation errors or fails to throw an exception when the cryptographic proof of integrity is missing or incorrect.
From an operational perspective, this vulnerability allows any remote attacker with network access to bypass authentication controls and gain administrative privileges over the device. By crafting a JWT payload containing arbitrary claims such as elevated role assignments or session identifiers, and attaching it without a valid RSA signature, an adversary can trick the WebUI into treating unauthenticated requests as legitimate administrator actions. This effectively nullifies the primary security boundary of the web interface, which is designed to restrict access to authorized personnel only. The ability to forge tokens means that traditional credential-based defenses are rendered useless for this specific attack vector, as the attacker does not need valid usernames or passwords but rather exploits the trust mechanism itself.
This vulnerability aligns with CWE-347, Improper Verification of Cryptographic Signature, which describes situations where a system fails to verify the integrity and authenticity of data protected by cryptographic means. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques related to Token Manipulation, specifically under the tactic of Initial Access or Privilege Escalation depending on whether the attacker starts with no access or low-level user access. The exploitation path typically involves intercepting a legitimate JWT structure, modifying its payload to include administrative permissions, and submitting it without recalculating or including a valid signature, relying entirely on the server's flawed verification logic.
To mitigate this vulnerability, immediate patching of the RDK-B firmware is required as provided by the vendor for version rdkb-2025q4-kirkstone.04.10.26 and subsequent releases. The fix must ensure that jst_functions.c strictly enforces signature verification using a robust cryptographic library that rejects any token where the signature does not match the expected algorithm and key material. Developers should implement strict error handling that treats validation failures as fatal errors rather than proceeding with default or permissive states. Additionally, implementing defense-in-depth measures such as rate limiting on authentication endpoints and monitoring for anomalous JWT patterns can help detect exploitation attempts in real-time while patches are being deployed. Regular security audits of cryptographic implementations are essential to prevent similar logic flaws from persisting in embedded systems where web interfaces serve as primary management planes.