EUVD-2026-70453
GHSA-x3mw-fvm5-jwf4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network vector and no privileges required are accurate; I:H added because payload forgery with valid HMAC is an integrity impact, not merely confidentiality.
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
2DescriptionCVE.org
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.
Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.
AnalysisAI
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared secrets for Webhook HMAC validation, violating the principle that secret generation must use cryptographically secure entropy sources (CWE-330). An unauthenticated remote attacker who can observe sufficient PRNG-derived webhook secrets - for example via API Publisher UI or intercepted webhook registrations - can statistically reconstruct the generator state and predict future secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Webhook feature must be in use within WSO2 API Manager or API Control Plane - the vulnerability is in the shared-secret generation path of the API Publisher's webhook subscription workflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N) scores this as medium-severity, reflecting that high attack complexity - gathering enough PRNG samples to reconstruct state - prevents trivial mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch described in WSO2 security advisory WSO2-2026-5174 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/); the advisory is the authoritative source for the fixed version number, which is not independently confirmed in the provided intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
Same weakness CWE-330 – Use of Insufficiently Random Values
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today