Vulnerability · Published Jul 22, 2026 · Assigned by redhat
CVE-2026-16615Librest: weak random number generation in pkce implementation
Medium 6.8
In plain English
A medium-severity security flaw in librest from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rest | 0.9.1-11.el10_2.1 | ALSA-2026:47085 |
| AlmaLinux:10 | rest-devel | 0.9.1-11.el10_2.1 | ALSA-2026:47085 |
| Debian:12 | librest | no fix listed | DEBIAN-CVE-2026-16615 |
| Debian:13 | librest | no fix listed | DEBIAN-CVE-2026-16615 |
| Debian:14 | librest | no fix listed | DEBIAN-CVE-2026-16615 |
| Rocky Linux:10 | rest | 0:0.9.1-11.el10_2.1 | RLSA-2026:47085 |
| Ubuntu:22.04:LTS | librest | no fix listed | UBUNTU-CVE-2026-16615 |
| Ubuntu:24.04:LTS | librest | no fix listed | UBUNTU-CVE-2026-16615 |
| Ubuntu:26.04:LTS | librest | no fix listed | UBUNTU-CVE-2026-16615 |
| Ubuntu:26.10 | librest | no fix listed | UBUNTU-CVE-2026-16615 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GNOME | librest | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
Weakness: CWE-338 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- RHSA-2026:47085 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:62222 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-16615 vdb-entry, x_refsource_REDHAT
- RHBZ#2504432 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/librest/-/issues/25