CVE-2025-13476

published 2026-03-05

CVE-2025-13476: Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension…

Priority P3 49 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)

Affected

4 ranges

Vendor	Product	Version range	Fixed in
rakuten	viber	—	—
rakuten	viber	25.6.0 – 25.8.1.0	—
rakuten_viber	rakuten_viber_cloak_android	>= 25.7.2.0g < 27.2.0.0g	27.2.0.0g
rakuten_viber	rakuten_viber_cloak_windows	>= v25.6.0.0 < v27.3.0.0	v27.3.0.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-327