CVE-2026-19506: RDK-B WebUI Auth Bypass Vulnerability

CVE-2026-19506 Overview

CVE-2026-19506 is a race condition vulnerability in the check.jst component of the Reference Design Kit for Broadband (RDK-B) WebUI. The flaw affects the rdkb-2025q4-kirkstone.04.10.26 release. Remote attackers can send concurrent authentication requests that exploit shared authentication state within the WebUI. Successful exploitation grants unauthorized access to the broadband gateway management interface. RDK-B powers a broad range of operator-deployed customer premises equipment, so exposure extends across residential gateways, cable modems, and similar broadband devices running the affected release.

Critical Impact
Concurrent authentication requests can bypass access controls in the RDK-B WebUI and grant remote attackers administrative access to broadband gateway devices.

Affected Products

RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26
check.jst authentication handler in RDK Broadband WebUI
Operator devices built on the affected RDK-B release

Discovery Timeline

2026-08-19 - CVE-2026-19506 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-19506

Vulnerability Analysis

The RDK-B WebUI provides the browser-based management interface for broadband gateways built on the Reference Design Kit. The check.jst template handles authentication checks for incoming session requests. The vulnerability arises when multiple authentication requests execute concurrently against shared authentication state. Because the state is read and updated without proper synchronization, one request can observe or manipulate intermediate values written by another. An attacker who issues parallel requests can win the race and be treated as authenticated without presenting valid credentials.

The result is unauthorized access to the administrative interface. From that position an attacker can alter gateway configuration, extract stored credentials, modify DNS or routing settings, or pivot into the subscriber network. The EPSS probability sits at 0.214% at the 11.97 percentile, indicating limited observed exploitation activity at the time of publication.

Root Cause

The root cause is unsynchronized access to shared authentication state within check.jst. Authentication decisions depend on values that can be read and mutated by more than one request handler at the same time. Without a lock, atomic compare-and-set, or per-session isolation, concurrent execution produces inconsistent authorization results.

Attack Vector

The attack requires network reachability to the RDK-B WebUI. An attacker issues multiple authentication requests in parallel, aiming to interleave their execution with the target's session logic. When the race is won, the WebUI returns an authenticated session to the attacker. No prior credentials or user interaction are required. Detailed technical analysis is available in the Pwr.edu whitehats blog on RDK-B vulnerabilities and the RDK Central WebUI documentation.

Detection Methods for CVE-2026-19506

Indicators of Compromise

Bursts of concurrent HTTP requests to WebUI authentication endpoints from a single source address
Successful authenticated sessions on the WebUI without a preceding valid credential submission
Configuration changes on the gateway that do not correlate with legitimate administrator activity
New or unexpected port forwards, DNS overrides, or firewall rules on the device

Detection Strategies

Instrument the WebUI to log authentication attempt volume per source and per session and alert on parallel request bursts against check.jst
Correlate WebUI login events with subsequent configuration changes to identify sessions established without a matching credential validation
Monitor upstream operator logs for anomalous management-plane access patterns targeting broadband gateways

Monitoring Recommendations

Ingest WebUI access logs and gateway management events into a centralized data lake for retention and analytics
Track authentication error rates and session creation rates per device to establish behavioral baselines
Alert on management-interface access from unexpected geographies or subscriber-side interfaces

How to Mitigate CVE-2026-19506

Immediate Actions Required

Restrict access to the RDK-B WebUI so that it is not reachable from untrusted networks or the WAN interface
Disable remote management on affected gateways until a fixed RDK-B build is deployed
Rotate administrative credentials on gateways that were exposed to untrusted networks
Coordinate with the device operator or vendor to schedule firmware updates to a patched RDK-B release

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Operators should track the RDK Central WebUI documentation and downstream vendor advisories for a build that supersedes rdkb-2025q4-kirkstone.04.10.26 with proper synchronization in check.jst.

Workarounds

Bind the WebUI listener to the LAN interface only and block WAN-side access at the gateway firewall
Rate-limit authentication requests per source address to reduce the window for winning the race
Place management interfaces behind an operator VPN or ACL-restricted management VLAN

bash

# Example iptables rules to restrict WebUI access to the LAN interface
iptables -A INPUT -i erouter0 -p tcp --dport 443 -j DROP
iptables -A INPUT -i erouter0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i brlan0 -p tcp --dport 443 -m connlimit --connlimit-above 5 -j REJECT