CVE-2026-16615 Librest: weak random number generation in pkce implementation
Weak random number generation in librest's PKCE implementation allows attackers to predict code verifiers and bypass OAuth protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-16615?
CVE-2026-16615 is a medium-severity vulnerability in GNOME Red Hat Enterprise Linux 10, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
Weakness: CWE-338
Which versions are affected by CVE-2026-16615?
Linux distribution packages (21)
rest AlmaLinux:10 | All versions | 0.9.1-11.el10_2.1 |
rest-devel AlmaLinux:10 | All versions | 0.9.1-11.el10_2.1 |
rest Red Hat:enterprise_linux:10.2 | All versions | 0:0.9.1-11.el10_2.1 |
rest-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.9.1-11.el10_2.1 |
rest-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:0.9.1-11.el10_2.1 |
rest-demo-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.9.1-11.el10_2.1 |
rest-devel Red Hat:enterprise_linux:10.2 | All versions | 0:0.9.1-11.el10_2.1 |
rest Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.9.1-11.el10_0.1 |
rest-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.9.1-11.el10_0.1 |
rest-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.9.1-11.el10_0.1 |
rest-demo-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.9.1-11.el10_0.1 |
rest-devel Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.9.1-11.el10_0.1 |
rest Rocky Linux:10 | All versions | 0:0.9.1-11.el10_2.1 |
librest SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 0.9.1-150600.3.3.1 |
librest SUSE:Linux Enterprise Server 16.0 | All versions | 0.9.1-160000.3.1 |
librest SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.8.0-13.3.1 |
librest SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.9.1-160000.3.1 |
librest0_7 SUSE:Linux Enterprise Workstation Extension 15 SP7 | All versions | 0.8.1-150600.4.3.1 |
librest openSUSE:Leap 16.0 | All versions | 0.9.1-160000.3.1 |
librest0_7 openSUSE:Leap 16.0 | All versions | 0.8.1-bp160.2.1 |
librest openSUSE:Tumbleweed | All versions | 0.10.2-2.1 |
How do I fix CVE-2026-16615?
Apply the vendor's patch.
Is CVE-2026-16615 being exploited?
There is no known exploitation of CVE-2026-16615 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:47085, AZL-93303, DEBIAN-CVE-2026-16615, GHSA-223h-642r-2f6v, MGASA-2026-0436, OESA-2026-3974 and 13 more.