Security Advisory WSO2-2026-5174/CVE-2026-3416¶

Published: July 04, 2026

Updated: July 04, 2026

Version: 1.0

Severity: Medium

CVSS Score: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVE IDs: CVE-2026-3416

AFFECTED PRODUCTS¶

• WSO2 API Control Plane: 4.5.0
• WSO2 API Manager: 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0

OVERVIEW¶

Predictable webhook HMAC secrets due to the use of non-cryptographic pseudorandom number generation.

DESCRIPTION¶

The API Publisher previously used a non-cryptographic pseudorandom number generator to generate shared secrets for Webhook HMAC validation. As this method does not provide sufficient entropy for security-sensitive operations, a sophisticated attacker may be able to predict future secrets. This could allow malicious actors to forge event payloads with valid HMAC signatures, thereby bypassing the API Gateway’s authenticity verification mechanisms.

IMPACT¶

Successful exploitation of this vulnerability could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.

SOLUTION¶

Community Users (Open Source)¶

Apply the relevant fixes to your product using the public fix(es) provided below.

• https://github.com/wso2/apim-apps/pull/1279

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders¶

Update your product to the specified update level or a higher update level to apply the fix.