CVE-2026-16615

Name of the Vulnerable Software and Affected Versions librest (affected versions not specified)

Description The PKCE implementation for OAuth authorization uses the g rand() function from the GLib API, which is a cryptographically insecure pseudo-random number generator (PRNG). Due to insufficient cryptographic entropy in the generated code verifier, a malicious actor can reverse-engineer the PRNG seed to predict or reconstruct the code verifier string. This allows an attacker to bypass PKCE protections and impersonate the client during the OAuth 2.0 authorization flow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.