CVE-2026-3416 Weak cryptography in WSO2 API Control Plane

Medium 5.9 Published 3 Sep 2026 Updated 3 Sep 2026

Attackers can predict webhook secrets to forge event payloads, bypassing API Gateway authentication and injecting unauthorized data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-3416?

CVE-2026-3416 is a medium-severity vulnerability in Wso2 Api Manager, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.

Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.

Weakness: CWE-330

Which versions are affected by CVE-2026-3416?

It affects 2 products.

Products include Wso2 Api Control Plane, Wso2 Api Manager.

How do I fix CVE-2026-3416?

No fix has been published for CVE-2026-3416 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-3416 being exploited?

There is no known exploitation of CVE-2026-3416 in the wild and no public exploit code.

All Wso2 Api Manager vulnerabilities

Sources

Also known as GHSA-x3mw-fvm5-jwf4.