Security update for librest

CVE-2026-16615 describes a weakness in librest's PKCE implementation for OAuth authorization, where the GRand function from the GLib API is used as a PRNG. This PRNG is cryptographically insecure, resulting in insufficient entropy in the generated code verifier. An attacker able to intercept the authorization code can reverse-engineer the PRNG seed to predict or reconstruct the code verifier, thereby bypassing PKCE protections and impersonating the client. The vulnerability affects librest versions >=10 and <10.2.1. Red Hat has issued an advisory recommending updating the affected package as no practical mitigation other than patching was identified.

An attacker positioned to intercept the OAuth authorization code can exploit the weak PRNG to predict the code verifier string, allowing them to bypass PKCE protections. This enables the attacker to obtain a valid access token, impersonate the user, access protected data, and perform actions on the user's behalf. The vulnerability impacts confidentiality and integrity but does not affect availability.

Red Hat advises updating the affected librest package to a fixed version as soon as possible. No practical mitigation other than applying the update has been identified. Users should follow the vendor advisory for the latest patch information.