CVE-2026-16615 identifies a cryptographic weakness in the librest library used by Red Hat Enterprise Linux 10. Specifically, the OAuth PKCE implementation relies on the GLib API's GRand function, which is not designed for cryptographic security. The insufficient entropy in the generated code verifier enables an attacker to reverse-engineer the PRNG seed, thereby predicting or reconstructing the verifier string. This flaw undermines the security guarantees of PKCE, allowing an attacker to bypass client verification in the OAuth 2.0 authorization flow and impersonate legitimate clients.

The vulnerability compromises the integrity of the OAuth 2.0 authorization flow by allowing attackers to bypass PKCE protections. Successful exploitation can lead to client impersonation, potentially exposing sensitive authorization tokens or enabling unauthorized access. The CVSS score of 6.8 (medium severity) reflects the network attack vector, required user interaction, and high impact on confidentiality and integrity, but no impact on availability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16615 for current remediation guidance. Until an official fix is available, users should consider mitigating the risk by avoiding use of the affected PKCE implementation or applying any recommended workarounds from Red Hat. Monitor the vendor advisory for updates on patches or temporary fixes.