A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62222 advisory.

    The rest packages provide a library for access to the RESTful web services.

    Security Fix(es):

    * librest: weak random number generation in PKCE implementation (CVE-2026-16615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21694-1 advisory.

    This update for librest fixes the following issue:

    - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-     random number       generator (bsc#1272399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3795-1 advisory.

    This update for librest fixes the following issue:

    - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-     random number       generator (bsc#1272399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3796-1 advisory.

    This update for librest fixes the following issue:

    - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-     random number       generator (bsc#1272399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21563-1 advisory.

    Changes in librest0_7:

    - CVE-2026-16615: Fix weak random number generation (bsc#1272399, glgo#GNOME/librest!44).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47085 advisory.

    * librest: weak random number generation in PKCE implementation (CVE-2026-16615)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47085 advisory.

    [0.9.1-11.1]
    - Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation)       Resolves: RHEL-213749

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47085 advisory.

    The rest packages provide a library for access to the RESTful web services.

    Security Fix(es):

    * librest: weak random number generation in PKCE implementation (CVE-2026-16615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from     the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated code     verifier lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random     number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to     bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
    (CVE-2026-16615)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342225	RHEL 10 : rest (RHSA-2026:62222)	Nessus	Red Hat Local Security Checks	Local	medium
342111	openSUSE 16 Security Update : librest (openSUSE-SU-2026:21694-1)	Nessus	SuSE Local Security Checks	Local	medium
341020	SUSE SLED15 / SLES15 Security Update : librest (SUSE-SU-2026:3795-1)	Nessus	SuSE Local Security Checks	Local	medium
340996	SUSE SLES12 Security Update : librest (SUSE-SU-2026:3796-1)	Nessus	SuSE Local Security Checks	Local	medium
335110	openSUSE 16 Security Update : librest0_7 (openSUSE-SU-2026:21563-1)	Nessus	SuSE Local Security Checks	Local	medium
330690	RockyLinux 10 : rest (RLSA-2026:47085)	Nessus	Rocky Linux Local Security Checks	Local	medium
330611	Oracle Linux 10 : rest (ELSA-2026-47085)	Nessus	Oracle Linux Local Security Checks	Local	medium
330429	RHEL 10 : rest (RHSA-2026:47085)	Nessus	Red Hat Local Security Checks	Local	medium
329440	Linux Distros Unpatched Vulnerability : CVE-2026-16615	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-16615

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium