CVE-2026-3416 PUBLISHED

Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

Assigner: WSO2
Reserved: 01.03.2026 Published: 03.09.2026 Updated: 03.09.2026

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.

Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.9

Product Status

Vendor WSO2
Product WSO2 API Manager
Versions Default: unaffected
  • unknown from 0 to 4.1.0 (excl.)
  • affected from 4.1.0 to 4.1.0.253 (excl.)
  • affected from 4.2.0 to 4.2.0.193 (excl.)
  • affected from 4.3.0 to 4.3.0.104 (excl.)
  • affected from 4.4.0 to 4.4.0.68 (excl.)
  • affected from 4.5.0 to 4.5.0.52 (excl.)
Vendor WSO2
Product WSO2 API Control Plane
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.53 (excl.)

Solutions

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/#solution

References

Problem Types

  • CWE-330: Use of Insufficiently Random Values CWE

Impacts

  • CAPEC-109 CAPEC-109: Predictable Pseudorandom Number Generator