CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:47085
https://access.redhat.com/errata/RHSA-2026:62222
https://access.redhat.com/security/cve/CVE-2026-16615
https://bugzilla.redhat.com/show_bug.cgi?id=2504432
https://gitlab.gnome.org/GNOME/librest/-/issues/25

Configurations

No configuration.

History

No history.

Information

Published : 2026-07-22 17:16

Updated : 2026-09-01 18:17

NVD link : CVE-2026-16615

Mitre link : CVE-2026-16615

CVE.ORG link : CVE-2026-16615

JSON object : View

Products Affected

No product.

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2026-16615", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16615", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T16:43:25.862726Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "GNOME", "product": "librest", "packageName": "librest", "collectionURL": "https://gitlab.gnome.org/GNOME/librest", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:0.9.1-11.el10_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rest", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:0.9.1-11.el10_0.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rest", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-07-22T17:16:55.863", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:47085", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:62222", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-16615", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504432", "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/librest/-/issues/25", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-338"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated \"code verifier\" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow."}], "lastModified": "2026-09-01T18:17:39.797", "sourceIdentifier": "secalert@redhat.com"}