# CVE-2026-16615: Librest: weak random number generation in pkce implementation

CVE-2026-16615 is fixed in 8 products on 1 platform, first by RHSA-2026:62222, released June 8, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-16615
- Priority: Routine
- CVSS: 6.8 (Moderate)
- EPSS: 0.0044
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 8, 2026
- Weakness: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-16615

## Description

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | librest opensuse-leap 16.0 | 0.9.1-160000.3.1 | [OPENSUSE-SU-2026:21694-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21694-1.md) | Aug 30, 2026 |
| Linux | librest sles 15.7 | 0.9.1-150600.3.3.1 | [SUSE-SU-2026:3795-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3795-1.md) | Aug 25, 2026 |
| Linux | librest sles 16.0 | 0.9.1-160000.3.1 | [SUSE-SU-2026:23564-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23564-1.md) | Aug 30, 2026 |
| Linux | librest0_7 opensuse-leap 16.0 | 0.8.1-bp160.2.1 | [OPENSUSE-SU-2026:21563-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21563-1.md) | Aug 11, 2026 |
| Linux | librest0_7 sles 15.7 | 0.8.1-150600.4.3.1 | [SUSE-SU-2026:3834-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3834-1.md) | Aug 27, 2026 |
| Linux | rest Fedora 43 | 0.10.2-5.fc43 | [FEDORA-2026-C2116E108F](https://patchblox.com/security/data/fix/linux/fedora-2026-c2116e108f.md) | Aug 26, 2026 |
| Linux | rest RHEL 10 | 0.9.1-11.el10_0.1 | [RHSA-2026:62222](https://patchblox.com/security/data/fix/linux/rhsa-2026-62222.md) | Jun 8, 2026 |
| Linux | rest almalinux 10 | 0.9.1-11.el10_2.1 | [ALSA-2026:47085](https://patchblox.com/security/data/fix/linux/alsa-2026-47085.md) | Jul 28, 2026 |
| Linux | rest ol 10 | 0:0.9.1-11.el10_2.1 | [ELSA-2026-47085](https://patchblox.com/security/data/fix/linux/elsa-2026-47085.md) | Jul 28, 2026 |
| Linux | rest rocky 10 | 0:0.9.1-11.el10_2.1 | [RLSA-2026:47085](https://patchblox.com/security/data/fix/linux/rlsa-2026-47085.md) | Jul 29, 2026 |
| Linux | rest-debuginfo Fedora 43 | 0.10.2-5.fc43 | [FEDORA-2026-C2116E108F](https://patchblox.com/security/data/fix/linux/fedora-2026-c2116e108f.md) | Aug 26, 2026 |
| Linux | rest-debugsource Fedora 43 | 0.10.2-5.fc43 | [FEDORA-2026-C2116E108F](https://patchblox.com/security/data/fix/linux/fedora-2026-c2116e108f.md) | Aug 26, 2026 |
| Linux | rest-demo Fedora 43 | 0.10.2-5.fc43 | [FEDORA-2026-C2116E108F](https://patchblox.com/security/data/fix/linux/fedora-2026-c2116e108f.md) | Aug 26, 2026 |
| Linux | rest-demo-debuginfo Fedora 43 | 0.10.2-5.fc43 | [FEDORA-2026-C2116E108F](https://patchblox.com/security/data/fix/linux/fedora-2026-c2116e108f.md) | Aug 26, 2026 |
| Linux | rest-devel Fedora 43 | 0.10.2-5.fc43 | [FEDORA-2026-C2116E108F](https://patchblox.com/security/data/fix/linux/fedora-2026-c2116e108f.md) | Aug 26, 2026 |
| Linux | rest-devel almalinux 10 | 0.9.1-11.el10_2.1 | [ALSA-2026:47085](https://patchblox.com/security/data/fix/linux/alsa-2026-47085.md) | Jul 28, 2026 |
| Linux | rest-devel ol 10 | 0:0.9.1-11.el10_2.1 | [ELSA-2026-47085](https://patchblox.com/security/data/fix/linux/elsa-2026-47085.md) | Jul 28, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.