CVE-2026-16615: librest OAuth PKCE Auth Bypass Flaw

CVE-2026-16615 Overview

A flaw exists in librest, a GNOME library used for accessing RESTful web services. The Proof Key for Code Exchange (PKCE) implementation for OAuth 2.0 authorization relies on the GRand function from the GLib API, which is a cryptographically insecure pseudo-random number generator (PRNG). The resulting code_verifier string lacks sufficient entropy. An attacker can reverse-engineer the PRNG seed to predict or reconstruct the verifier, bypass PKCE protections, and impersonate the client during the OAuth 2.0 authorization flow. The weakness is categorized under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator.

Critical Impact
An attacker who predicts the PKCE code verifier can intercept an authorization code and complete the token exchange, impersonating a legitimate OAuth 2.0 client and gaining access to protected resources.

Affected Products

GNOME librest — PKCE OAuth authorization component
Applications and desktop clients that consume librest for OAuth 2.0 flows
Linux distributions packaging vulnerable versions of librest (see Red Hat CVE-2026-16615 Advisory)

Discovery Timeline

2026-07-22 - CVE CVE-2026-16615 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16615

Vulnerability Analysis

PKCE extends OAuth 2.0 to protect public clients against authorization code interception. The client generates a high-entropy random code_verifier, derives a code_challenge (typically SHA256(code_verifier)), and sends the challenge with the authorization request. At token exchange, the client presents the original code_verifier, which the authorization server validates against the previously stored challenge.

In librest, the code_verifier is generated using GLib's GRand API. GRand implements a Mersenne Twister designed for statistical randomness, not cryptographic use. Its internal state can be recovered from a limited number of observed outputs, and the seed space is bounded. Any attacker able to influence or observe timing, or to obtain a sample of PRNG output, can reconstruct subsequent verifier values.

Because the entire security guarantee of PKCE depends on the secrecy and unpredictability of the code_verifier, weakening the generator collapses the mitigation. The flaw does not affect confidentiality of data at rest but undermines the authentication and integrity properties of the OAuth flow.

Root Cause

The root cause is the use of a non-cryptographic PRNG (GRand) to produce security-sensitive material. A cryptographically secure source such as getrandom(2), /dev/urandom, or GLib's own cryptographic primitives should have been used instead.

Attack Vector

The attack requires the adversary to intercept the authorization code, which is possible via a malicious application registered for the same URI scheme, a compromised redirect endpoint, or a network-position attacker in the presence of misconfigured transport. With the code in hand, the attacker predicts the code_verifier by exploiting GRand predictability and completes the token exchange as if they were the legitimate client. User interaction with the OAuth prompt is required, consistent with the vector metadata for this CVE.

No verified public exploit code is available. See the GNOME librest Issue #25 and Red Hat Bugzilla #2504432 for upstream discussion.

Detection Methods for CVE-2026-16615

Indicators of Compromise

Unexpected successful OAuth 2.0 token exchanges immediately following an authorization code issuance from a different client instance or device fingerprint.
Duplicate or replayed code_verifier values observed at the authorization server, or code_verifier values with low measured entropy.
Anomalous access to protected APIs from tokens issued to desktop clients built on librest.

Detection Strategies

Inventory installed packages and identify applications linked against librest using ldd or distribution package queries.
Audit authorization server logs for token requests where the client instance, IP, or user-agent differs from the entity that received the authorization code.
Statistically analyze captured code_verifier samples for signs of GRand/Mersenne Twister output rather than uniform cryptographic randomness.

Monitoring Recommendations

Alert on OAuth token exchanges completed from IP ranges or devices that did not initiate the corresponding authorization request.
Monitor upstream advisories from Red Hat and the GNOME project for patched librest releases and backports.
Track process execution and library loading for applications consuming librest to correlate patch state with runtime behavior.

How to Mitigate CVE-2026-16615

Immediate Actions Required

Update librest to the patched version supplied by your Linux distribution as soon as it becomes available.
Restart or relaunch any long-running application that dynamically links librest after patching so the fixed library is loaded.
Rotate OAuth client credentials and revoke active refresh tokens for clients that used the vulnerable librest version during a compromise window.

Patch Information

Refer to the Red Hat CVE-2026-16615 Advisory and upstream GNOME librest Issue #25 for the fix status. The upstream remediation replaces GRand-based verifier generation with a cryptographically secure random source. Apply distribution updates through the standard package manager once the fixed package is published.

Workarounds

Enforce short authorization code lifetimes and single-use semantics on the authorization server to reduce the interception window.
Require confidential client authentication (client secret or mTLS) in addition to PKCE where the deployment model allows.
Restrict OAuth redirect URIs to loopback interfaces or claimed HTTPS URIs to limit the ability of a local malicious app to receive the authorization code.

bash

# Check installed librest version on RHEL/Fedora-based systems
rpm -q rest

# Check on Debian/Ubuntu-based systems
dpkg -l | grep librest

# Update after the patched package is published
sudo dnf update rest        # RHEL/Fedora
sudo apt-get update && sudo apt-get install --only-upgrade librest-1.0-0   # Debian/Ubuntu

# Identify running processes linked against librest
for pid in $(pgrep -a . | awk '{print $1}'); do
  if grep -q librest /proc/$pid/maps 2>/dev/null; then
    echo "PID $pid uses librest: $(cat /proc/$pid/comm)"
  fi
done