Description
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNOME | librest | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | librest | No fix yet | — |
| Debian 13 | librest | No fix yet | — |
| Debian 12 | librest | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | librest | No fix yet | — |
| Ubuntu 26.04 LTS | librest | No fix yet | — |
| Ubuntu 24.04 LTS | librest | No fix yet | — |
| Ubuntu 22.04 LTS | librest | No fix yet | — |
| Ubuntu 20.04 LTS | librest | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | librest | No fix yet | — |
| Ubuntu 16.04 LTS | librest | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rest +1 | 0.9.1-11.el10_2.1 | RHSA-2026:47085 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | rest +1 | 0.9.1-11.el10_0.1 | RHSA-2026:62222 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rest +1 | 0.9.1-11.el10_2.1 | ALSA-2026:47085 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | rest | 0.9.1-11.el10_2.1 | RLSA-2026:47085 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | librest | 0.9.1-150600.3.3.1 | SUSE-SU-2026:3795-1 |
| SLES 15 SP7 | librest0_7 | 0.8.1-150600.4.3.1 | SUSE-SU-2026:3834-1 |
| SLES 12 SP5 | librest | 0.8.0-13.3.1 | SUSE-SU-2026:3796-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | librest | 0.9.1-160000.3.1 | SUSE-SU-2026:23564-1 |
| SLES 16.0 | librest | 0.9.1-160000.3.1 | SUSE-SU-2026:23564-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | librest | 0.10.2-2.1 | openSUSE-SU-2026:11477-1 |
| openSUSE Leap 16.0 | librest | 0.9.1-160000.3.1 | openSUSE-SU-2026:21694-1 |
| openSUSE Leap 16.0 | librest0_7 | 0.8.1-bp160.2.1 | openSUSE-SU-2026:21563-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rest | 0.9.0-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rest +1 | 0.9.1-11.el10_2.1 | ELSA-2026-47085 |
Advisories 13
- ALSA-2026:47085 Important: rest security update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:23564-1 Security update for librest SUSE / openSUSE Security Updates · Sep 29, 2026
- WID-SEC-2026-2553 Red Hat Enterprise Linux (librest, pipewire): Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2026
- SUSE-SU-2026:3834-1 Security update for librest0_7 SUSE / openSUSE Security Updates · Sep 4, 2026
- RHSA-2026:62222 Red Hat Security Advisory: rest security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- RHSA-2026:47085 Red Hat Security Advisory: rest security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- openSUSE-SU-2026:21694-1 Security update for librest SUSE / openSUSE Security Updates · Aug 31, 2026
- SUSE-SU-2026:3795-1 Security update for librest SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:3796-1 Security update for librest SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21563-1 Security update for librest0_7 SUSE / openSUSE Security Updates · Aug 12, 2026
- openSUSE-SU-2026:11477-1 librest-1_0-0-0.10.2-2.1 on GA media SUSE / openSUSE Security Updates · Aug 10, 2026
- RLSA-2026:47085 Important: rest security update Rocky Linux Security Advisories · Jul 29, 2026
- ELSA-2026-47085 Important: rest security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 28, 2026
References
- RHSA-2026:47085 vendor-advisory
- RHSA-2026:62222 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-16615 vdb-entry
- RHBZ#2504432 issue-tracking
- https://gitlab.gnome.org/GNOME/librest/-/issues/25