AZL-93303

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93303.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-93303
Upstream
  • CVE-2026-16615
Published
2026-07-22T17:16:55Z
Modified
2026-09-01T05:28:09Z
Summary
CVE-2026-16615 affecting package rest for versions less than 0.9.0-2
Details

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

References

Affected packages

Azure Linux:3 / rest

Package

Name
rest
Purl
pkg:rpm/azure-linux/rest

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.0-2

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93303.json"