CVE-2026-3416

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification. Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:api_control_plane::::::::
	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::

History

No history.

Information

Published : 2026-09-03 13:05

Updated : 2026-09-15 18:02

NVD link : CVE-2026-3416

Mitre link : CVE-2026-3416

CVE.ORG link : CVE-2026-3416

JSON object : View

Products Affected

wso2

api_control_plane
api_manager

CWE

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2026-3416", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3416", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-03T12:55:07.421469Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.1.0", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.253", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.193", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.104", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.68", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.52", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.53", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-03T13:05:37.847", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/", "tags": ["Patch", "Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.\n\nSuccessful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise."}], "lastModified": "2026-09-15T18:02:04.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FEB4245-50CD-43FC-AE9B-FBF02739B4AC", "versionEndExcluding": "4.5.0.53", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65F7A6AE-FEE8-4B9E-8CAF-6F49AA939553", "versionEndExcluding": "4.1.0.253", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "818A1209-F67E-40B3-BF10-B890E3AD8A63", "versionEndExcluding": "4.2.0.193", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C8B78FF-DD1F-4C94-81DB-27A98EFA559B", "versionEndExcluding": "4.3.0.104", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86F14FD5-7766-469C-9D7D-318DF9089635", "versionEndExcluding": "4.4.0.68", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44B6BFA2-2FD5-4992-9A43-3B44976FDE57", "versionEndExcluding": "4.5.0.52", "versionStartIncluding": "4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}