CVE-2026-3416: CWE-330: Use of Insufficiently Random Values in WSO2 WSO2 API Manager

The API Publisher component in WSO2 API Manager versions 4.1.0 to 4.5.0 uses a non-cryptographic pseudorandom number generator (PRNG) to generate shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future shared secrets. By predicting these secrets, an attacker can forge event payloads with valid HMAC signatures, effectively bypassing the API Gateway's authenticity verification mechanisms. This vulnerability is identified as CWE-330 (Use of Insufficiently Random Values).

Successful exploitation allows an attacker to predict shared secrets used for Webhook HMAC validation, enabling the forging of event payloads with valid HMAC signatures. This bypasses API Gateway authenticity checks and may lead to unauthorized event injection, data manipulation, or compromise of downstream systems. The CVSS 3.1 base score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor WSO2 advisories for updates and consider restricting access to API Publisher components or implementing additional validation controls as interim measures.