CVE-2026-3416: The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This…

PriorityP347high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.36%

28.0th percentile

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification. Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.53	4.5.0.53
wso2	api_manager	>= 4.1.0 < 4.1.0.253	4.1.0.253
wso2	api_manager	>= 4.2.0 < 4.2.0.193	4.2.0.193
wso2	api_manager	>= 4.3.0 < 4.3.0.104	4.3.0.104
wso2	api_manager	>= 4.4.0 < 4.4.0.68	4.4.0.68
wso2	api_manager	>= 4.5.0 < 4.5.0.52	4.5.0.52
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.53	4.5.0.53
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.253	4.1.0.253
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.193	4.2.0.193
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.104	4.3.0.104
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.68	4.4.0.68
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.52	4.5.0.52

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.