Back to overview

CVE-2026-16615

MEDIUM
6.8
CVSS 3.1
Description
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

Metadata

CVE ID
CVE-2026-16615
State
PUBLISHED
Assigner
redhat
Reserved
2026-07-22 14:38 UTC
Published
2026-07-22 16:12 UTC
Last updated
2026-07-22 16:43 UTC
Primary CWE
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator…
Vendor / Product
Red Hat / Red Hat Enterprise Linux 10
Sources
cve.org  ·  NVD

Severity & Metrics

6.8 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Red Hat Red Hat Enterprise Linux 10 — —
Weakness (CWE)
CWESourceDescription
CWE-338 cna Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.8 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References (3)
Back to overview