CVE-2026-16615

Name	CVE-2026-16615
Description	A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1142715

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
librest (PTS)	bullseye	0.8.1-1.1	vulnerable
	bookworm, trixie	0.9.1-6	vulnerable
	forky, sid	0.10.2-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
librest	source	(unstable)	(unfixed)			1142715

[trixie] - librest <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2504432
https://gitlab.gnome.org/GNOME/librest/-/issues/25