Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-16615— Librest: weak random number generation in pkce implementation

Quick assessment

Affected
GNOME librest
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GNOME librest是GNOME基金会开源的一个功能库。 GNOME librest存在加密问题漏洞，该漏洞源于librest中的PKCE实现使用GLib API中的GRand函数，这是一种加密不安全的伪随机数生成器，生成的“code verifier”缺乏足够的加密熵，导致恶意攻击者可以逆向工程伪随机数生成器种子以预测或重建验证码字符串，从而绕过PKCE保护并在OAuth 2.0授权流程中成功冒充客户端。

CVSS 6.8 · Medium EPSS 0.25% · P16

Affected Version Matrix 3

VendorProduct Version RangeStatus
GNOME librest any affected
Red Hat Red Hat Enterprise Linux 10 0:0.9.1-11.el10_2.1< * unaffected
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.9.1-11.el10_0.1< * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16615

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Librest: weak random number generation in pkce implementation
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用具有密码学弱点缺陷的PRNG
Source: CVE Program / CVE List V5
Vulnerability Title
GNOME librest 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GNOME librest是GNOME基金会开源的一个功能库。 GNOME librest存在加密问题漏洞，该漏洞源于librest中的PKCE实现使用GLib API中的GRand函数，这是一种加密不安全的伪随机数生成器，生成的“code verifier”缺乏足够的加密熵，导致恶意攻击者可以逆向工程伪随机数生成器种子以预测或重建验证码字符串，从而绕过PKCE保护并在OAuth 2.0授权流程中成功冒充客户端。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
GNOME librest - -
Red Hat Red Hat Enterprise Linux 10 0:0.9.1-11.el10_2.1 ~ * cpe:/o:redhat:enterprise_linux:10.2
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.9.1-11.el10_0.1 ~ * cpe:/o:redhat:enterprise_linux_eus:10.0

II. Public POCs for CVE-2026-16615

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-16615

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-16615 (5)

IV. Related Vulnerabilities

Same vendor: GNOME
Same weakness: CWE-338

V. Comments for CVE-2026-16615

No comments yet

Leave a comment