CVE-2026-19505 Overview
CVE-2026-19505 is an authentication bypass vulnerability in the Reference Design Kit for Broadband (RDK-B) WebUI component. The flaw resides in jst_functions.c within the rdkb-2025q4-kirkstone.04.10.26 release. The code performs improper cryptographic signature verification on JSON Web Tokens (JWTs). A remote attacker can forge a JWT containing an invalid RSA signature and gain administrative access to the WebUI. The vulnerability affects deployments of RDK-B, an open-source software stack used by cable and broadband operators for customer-premises equipment such as gateways and set-top boxes.
Critical Impact
Remote attackers can bypass authentication and obtain administrative access to RDK-B WebUI by presenting a forged JWT with an invalid RSA signature, exposing broadband gateway management functions.
Affected Products
- RDK-B WebUI component rdkb-2025q4-kirkstone.04.10.26
- Broadband gateways and CPE devices built on RDK-B integrating the affected WebUI
- Deployments using jst_functions.c for JWT validation
Discovery Timeline
- 2026-08-19 - CVE-2026-19505 published to NVD
- 2026-08-19 - Vulnerability analysis published on the PWR Whitehats blog
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-19505
Vulnerability Analysis
The RDK-B WebUI uses JWTs to authenticate administrative sessions. The jst_functions.c module implements the token verification logic, including RSA signature validation. The implementation fails to correctly enforce the outcome of the cryptographic signature check. As a result, tokens presenting a syntactically valid structure but an invalid RSA signature are accepted as authentic. An attacker who crafts a JWT with arbitrary claims, including administrator identity claims, can present it to the WebUI and be granted a privileged session. This class of defect is tracked under improper signature verification and enables full authentication bypass without prior credentials or user interaction.
Root Cause
The root cause is improper handling of the signature verification result inside jst_functions.c. The token parser accepts JWTs where the RSA signature does not validate against the expected public key. Detailed analysis is available in the PWR Whitehats blog post on multiple RDK-B vulnerabilities.
Attack Vector
An attacker with network reachability to the WebUI service crafts a JWT containing administrator claims and an arbitrary RSA signature. The attacker submits the token in the authentication header or session cookie used by the WebUI. Because the verification routine does not reject invalid signatures, the WebUI treats the request as authenticated and grants administrative privileges. Refer to the RDK Central WebUI documentation for architectural context.
No verified proof-of-concept code is publicly available. See the referenced advisory for exploitation details.
Detection Methods for CVE-2026-19505
Indicators of Compromise
- Successful WebUI administrative sessions originating from unexpected source IPs or geolocations.
- Authentication events lacking a preceding successful password or credential exchange.
- WebUI configuration changes correlated with JWT-bearing requests that carry unfamiliar kid, issuer, or subject claim values.
Detection Strategies
- Inspect HTTP request logs for JWTs in Authorization headers or session cookies presented to the RDK-B WebUI and validate signatures independently.
- Alert on administrative actions performed by sessions that were not preceded by a legitimate login workflow.
- Correlate WebUI access with device management plane telemetry to identify anomalous privileged operations.
Monitoring Recommendations
- Enable verbose logging on the WebUI service to capture JWT claims, signing algorithm, and verification outcomes.
- Forward WebUI and gateway management logs to a centralized SIEM for retention and correlation.
- Monitor for repeated failed or malformed JWT submissions from a single source, which may indicate token forgery attempts.
How to Mitigate CVE-2026-19505
Immediate Actions Required
- Restrict network access to the RDK-B WebUI so that only trusted management networks can reach the administrative interface.
- Rotate JWT signing keys and invalidate active administrative sessions on affected devices.
- Audit recent administrative activity on RDK-B gateways for signs of unauthorized configuration change.
Patch Information
No fixed version is listed in the NVD entry at time of publication. Operators should track the RDK Central WebUI component documentation and the PWR Whitehats disclosure for corrected releases and apply updates to jst_functions.c once available.
Workarounds
- Block external access to the WebUI at the network edge and permit only management VLANs or VPN-attached hosts.
- Place a reverse proxy in front of the WebUI that performs independent JWT signature validation before forwarding requests.
- Disable the WebUI entirely on devices where administrative access is not required from remote networks.
# Example iptables restriction limiting WebUI access to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
