{"api_version":"1","generated_at":"2026-09-06T03:39:15+00:00","cve":"CVE-2026-3416","urls":{"html":"https://cve.report/CVE-2026-3416","api":"https://cve.report/api/cve/CVE-2026-3416.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-3416","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-3416"},"summary":{"title":"Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads","description":"The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.\n\nSuccessful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.","state":"PUBLISHED","assigner":"WSO2","published_at":"2026-09-03 13:05:37","updated_at":"2026-09-03 17:50:15"},"problem_types":["CWE-330","CWE-330 CWE-330: Use of Insufficiently Random Values"],"metrics":[{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3416","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3416","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 4.1.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.1.0 4.1.0.253 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.193 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.104 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.4.0 4.4.0.68 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.5.0 4.5.0.52 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"affected 4.5.0 4.5.0.53 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"3416","cve":"CVE-2026-3416","epss":"0.002720000","percentile":"0.193200000","score_date":"2026-09-05","updated_at":"2026-09-06 00:04:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-3416","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-03T12:55:07.421469Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-03T12:55:15.634Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"4.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.1.0.253","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.193","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.104","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.68","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.52","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.53","status":"affected","version":"4.5.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.253","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.193","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.104","versionStartIncluding":"4.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.4.0.68","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.52","versionStartIncluding":"4.5.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.53","versionStartIncluding":"4.5.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.\n\nSuccessful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise."}],"value":"The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.\n\nSuccessful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise."}],"impacts":[{"capecId":"CAPEC-109","descriptions":[{"lang":"en","value":"CAPEC-109 CAPEC-109: Predictable Pseudorandom Number Generator"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-330","description":"CWE-330: Use of Insufficiently Random Values","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-03T12:35:32.628Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/#solution</span></a> <br>"}],"value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/#solution"}],"source":{"advisory":"WSO2-2026-5174","discovery":"INTERNAL"},"title":"Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2026-3416","datePublished":"2026-09-03T12:35:32.628Z","dateReserved":"2026-03-01T18:48:54.097Z","dateUpdated":"2026-09-03T12:55:15.634Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-03 13:05:37","lastModifiedDate":"2026-09-03 17:50:15","problem_types":["CWE-330","CWE-330 CWE-330: Use of Insufficiently Random Values"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-03T12:55:07.421469Z","id":"CVE-2026-3416","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"3416","Ordinal":"1","Title":"Predictable Pseudorandom Number Generation via Webhook HMAC Secr","CVE":"CVE-2026-3416","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"3416","Ordinal":"1","NoteData":"The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.\n\nSuccessful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.","Type":"Description","Title":"Predictable Pseudorandom Number Generation via Webhook HMAC Secr"}]}}}