The librest library's implementation of PKCE for OAuth authorization relies on the GRand function from the GLib API to generate the code verifier. GRand is a cryptographically insecure pseudo-random number generator, leading to code verifiers that lack sufficient cryptographic entropy. An attacker can reverse-engineer the PRNG seed to predict or reconstruct the code verifier string, thereby bypassing PKCE protections and impersonating the client in the OAuth 2.0 authorization process. This vulnerability is identified as CVE-2026-16615 and is associated with CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). The CVSS v3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact.

An attacker can bypass PKCE protections in OAuth 2.0 authorization by predicting or reconstructing the code verifier due to insufficient cryptographic entropy. This allows successful client impersonation during the OAuth authorization flow, potentially leading to unauthorized access to protected resources. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Red Hat advisory and related vendor communications for updates on patches or mitigations. Until a fix is available, consider mitigating risk by avoiding reliance on the affected PKCE implementation or employing additional compensating controls in OAuth authorization flows.