The flaw is in librest’s PKCE implementation for OAuth 2.0, where the code verifier is created using GLib’s GRand pseudo‑random number generator. This PRNG does not provide sufficient cryptographic entropy, allowing a malicious actor to determine or reconstruct the code verifier by reverse‑engineering the seed. An attacker who can predict the verifier can satisfy the PKCE challenge, effectively bypassing the protection and impersonating the client during the OAuth flow, thereby obtaining unauthorized access to protected resources that trust the OAuth exchange.

The affected product is GNOME:librest, which is included in Red Hat Enterprise Linux 10. The advisory only lists this product, and any system that employs librest to perform OAuth 2.0 authorization and PKCE is at risk.

The CVSS score of 6.8 indicates moderate severity. The EPSS score of < 1 % shows a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely remote; an adversary can initiate an OAuth authorization request against a server that uses librest, then reconstruct the code verifier to receive a stolen access token. The weakness arises from deterministic PRNG usage, so the exploit does not require local access or privileged execution, making remote exploitation possible when the client software is deployed in a vulnerable environment.