Cryptographic Vulnerability in librest OAuth Implementation by Red Hat
CVE-2026-16615
6.8MEDIUM
What is CVE-2026-16615?
A vulnerability exists in the PKCE implementation of the librest library, which utilizes the GRand function from the GLib API. This function employs a cryptographically insecure pseudo-random number generator (PRNG), leading to insufficient cryptographic entropy in the generated 'code verifier.' Attackers could exploit this weakness to reverse-engineer the PRNG seed, potentially allowing them to predict or reconstruct the code verifier string. This exploitation could result in successful impersonation of the client during the OAuth 2.0 authorization flow, undermining the integrity of the authentication process and exposing sensitive user data.
References
CVSS V3.1
Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Cole Blakley for reporting this issue.