# CVE-2026-16615: GNOME librest weak PRNG in OAuth PKCE implementation

Source: https://junglewise.ai/threats/cve-2026-16615-gnome-librest-weak-prng-in-oauth-pkce-implementation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-16615 · Severity: medium · CVSS 6.8 · Published 2026-07-22

A security flaw was found in librest, a software library used by applications to interact with web services. The library uses a weak method for generating security codes during the login process (OAuth), making these codes predictable. An attacker could exploit this to impersonate a legitimate user or application, potentially gaining unauthorized access to account data.

Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-16615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16615 being exploited in the wild.

**How severe is CVE-2026-16615?** Medium severity, with a CVSS score of 6.8, published 22 July 2026.

**Which products and versions are affected?** Gnome Librest All versions.

**Is there a fix for CVE-2026-16615?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16615 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16615?** Check whether you run Gnome Librest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in librest's PKCE implementation for OAuth 2.0. The 'random_string' function in 'rest/rest-utils.c' utilizes the GLib 'GRand' API, which is based on the Mersenne Twister algorithm and is not cryptographically secure. Because this PRNG lacks sufficient entropy, an attacker can reverse-engineer the seed to predict or reconstruct the 'code verifier' string. This allows a remote attacker to bypass PKCE protections and successfully impersonate the client during the authorization flow. The issue affects all versions of librest and requires the attacker to intercept or participate in an OAuth flow where PKCE is utilized.

## Affected products

- GNOME librest All versions
- Red Hat Red Hat Enterprise Linux 10

## Timeline

- 2026-07-21: disclosed: Issue reported via Red Hat Bugzilla and GNOME GitLab
- 2026-07-22: advisory: NVD and Red Hat published advisory details

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-16615](https://access.redhat.com/security/cve/CVE-2026-16615)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2504432](https://bugzilla.redhat.com/show_bug.cgi?id=2504432)
- [https://gitlab.gnome.org/GNOME/librest/-/issues/25](https://gitlab.gnome.org/GNOME/librest/-/issues/25)