CVE-2026-16615

MediumCVSS 6.8/10Last modified Sep 1, 2026

Description

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-338

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Sep 1, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-166168.6The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticatedCVE-2026-166178.8The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the CVE-2026-166189.8The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writingCVE-2026-166197.5The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them aCVE-2026-16627.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 thCVE-2026-166207.5The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configurCVE-2026-166215.3The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completinCVE-2026-166238.0The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP patternCVE-2026-166249.6Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvaliCVE-2026-166269.3Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affectCVE-2026-166279.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowCVE-2026-166285.3A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT