A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_47085 advisory.

    * librest: weak random number generation in PKCE implementation (CVE-2026-16615)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4baee57e28 advisory.

    Fix for https://access.redhat.com/security/cve/cve-2026-16615


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c2116e108f advisory.

    Fix for https://access.redhat.com/security/cve/cve-2026-16615


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-df38653cf2 advisory.

    Fix for https://access.redhat.com/security/cve/cve-2026-16615


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62222 advisory.

    The rest packages provide a library for access to the RESTful web services.

    Security Fix(es):

    * librest: weak random number generation in PKCE implementation (CVE-2026-16615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21694-1 advisory.

    This update for librest fixes the following issue:

    - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-     random number       generator (bsc#1272399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3795-1 advisory.

    This update for librest fixes the following issue:

    - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-     random number       generator (bsc#1272399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3796-1 advisory.

    This update for librest fixes the following issue:

    - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-     random number       generator (bsc#1272399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21563-1 advisory.

    Changes in librest0_7:

    - CVE-2026-16615: Fix weak random number generation (bsc#1272399, glgo#GNOME/librest!44).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47085 advisory.

    * librest: weak random number generation in PKCE implementation (CVE-2026-16615)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47085 advisory.

    [0.9.1-11.1]
    - Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation)       Resolves: RHEL-213749

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47085 advisory.

    The rest packages provide a library for access to the RESTful web services.

    Security Fix(es):

    * librest: weak random number generation in PKCE implementation (CVE-2026-16615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from     the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated code     verifier lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random     number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to     bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
    (CVE-2026-16615)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
358149	Rocky Linux 10.2 [CIQ] Security Update: rest / rest-debuginfo / rest-debugsource / rest-devel (crlsa-2026_47085)	Nessus	Rocky Linux Local Security Checks	Local	medium
344894	Fedora 45 : rest (2026-4baee57e28)	Nessus	Fedora Local Security Checks	Local	medium
344671	Fedora 43 : rest (2026-c2116e108f)	Nessus	Fedora Local Security Checks	Local	medium
344669	Fedora 44 : rest (2026-df38653cf2)	Nessus	Fedora Local Security Checks	Local	medium
342225	RHEL 10 : rest (RHSA-2026:62222)	Nessus	Red Hat Local Security Checks	Local	medium
342111	openSUSE 16 Security Update : librest (openSUSE-SU-2026:21694-1)	Nessus	SuSE Local Security Checks	Local	medium
341020	SUSE SLED15 / SLES15 Security Update : librest (SUSE-SU-2026:3795-1)	Nessus	SuSE Local Security Checks	Local	medium
340996	SUSE SLES12 Security Update : librest (SUSE-SU-2026:3796-1)	Nessus	SuSE Local Security Checks	Local	medium
335110	openSUSE 16 Security Update : librest0_7 (openSUSE-SU-2026:21563-1)	Nessus	SuSE Local Security Checks	Local	medium
330690	RockyLinux 10 : rest (RLSA-2026:47085)	Nessus	Rocky Linux Local Security Checks	Local	medium
330611	Oracle Linux 10 : rest (ELSA-2026-47085)	Nessus	Oracle Linux Local Security Checks	Local	medium
330429	RHEL 10 : rest (RHSA-2026:47085)	Nessus	Red Hat Local Security Checks	Local	medium
329440	Linux Distros Unpatched Vulnerability : CVE-2026-16615	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-16615

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium