CVE-2026-3416

The API Publisher component of WSO2 API Manager and API Control Plane generated shared secrets for Webhook HMAC validation using a non-cryptographic pseudorandom number generator (CWE-330), which lacks sufficient entropy for security-sensitive operations. A remote, unauthenticated attacker able to predict these secrets could forge event payloads carrying valid HMAC signatures, bypassing the API Gateway's authenticity verification. Successful exploitation enables unauthorized event injection, data manipulation, or compromise of downstream systems that trust the webhook events. Affected deployments are those using WSO2 API Manager or API Control Plane where webhook subscriptions were created via API Publisher; specific vulnerable version ranges were not stated in the advisory data. No public PoC exists, the flaw is not in the CISA KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so exploitation in the wild is not currently known.

What to do: Apply WSO2's patched builds of API Manager and API Control Plane as soon as they are available, since the fix replaces the weak PRNG with a cryptographically secure random generator. Regenerate all webhook shared secrets and re-register downstream webhook subscriptions, treating every previously generated secret as potentially predictable. Audit API Gateway and webhook receiver logs for events bearing valid HMAC signatures that do not correspond to legitimate publisher activity.