The vulnerability in GNOME librest (CVE-2026-16615) arises from the use of the GRand function in the GLib API for generating PKCE code verifier strings in OAuth authorization. GRand is a cryptographically insecure PRNG, resulting in code verifiers with low entropy. An attacker can exploit this weakness by reverse-engineering the PRNG seed to predict or reconstruct the code verifier, thereby bypassing PKCE protections and impersonating the client during OAuth 2.0 authorization. Red Hat Enterprise Linux 10 and associated CodeReady Linux Builder distributions are affected. Red Hat has released security updates (rest-0.9.1-11.el10_2.1) to fix this issue, as documented in their advisory RHSA-2026:47085.

The vulnerability allows an attacker to bypass PKCE protections in OAuth 2.0 authorization flows by predicting or reconstructing the code verifier string due to weak randomness. This can lead to client impersonation and unauthorized access with high confidentiality and integrity impact. Availability is not affected. The CVSS v3.1 base score is 6.8 (medium severity), reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact.

Red Hat has released an official security update fixing this vulnerability in librest for Red Hat Enterprise Linux 10 and related distributions. Users should apply the updated packages (rest-0.9.1-11.el10_2.1) as provided in Red Hat advisory RHSA-2026:47085. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying this update mitigates the vulnerability by replacing the weak PRNG with a cryptographically secure alternative. No other mitigation actions are specified or required.