CVE-2025-13476

Rakuten Viber uses broken or risky cryptographic Algorithm

State: Published
Severity: 9.8 Critical
Published: Mar 5, 2026
Updated: Mar 6, 2026
Reserved: Nov 20, 2025

Description

Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Rakuten Viber Cloak - AndroidRakuten Viber	25.7.2.0g to before 27.2.0.0gAffected
Rakuten Viber Cloak - WindowsRakuten Viber	v25.6.0.0 to before v27.3.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.