EUVD-2026-70453
GHSA-x3mw-fvm5-jwf4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic random values
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 15, 2026
Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attacker to forecast future webhook signing secrets and forge event payloads that the API Gateway accepts as authentic. All supported release lines are affected — API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0 and 4.5.0, plus API Control Plane 4.5.0 — with fixes shipped as vendor update levels (for example 4.4.0.68, 4.3.0.104, 4.5.0.52 and 4.1.0.253). Exploitation is not currently observed: EPSS is only 0.27% (19th percentile), CISA's SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so the practical risk is driven by the sensitivity of the webhook-integrated downstream systems rather than by mass scanning activity.
Earlier versions of this analysis (1)
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared secrets for Webhook HMAC validation, violating the principle that secret generation must use cryptographically secure entropy sources (CWE-330). An unauthenticated remote attacker who can observe sufficient PRNG-derived webhook secrets - for example via API Publisher UI or intercepted webhook registrations - can statistically reconstruct the generator state and predict future secrets. With a predicted secret, the attacker forges event payloads bearing valid HMAC signatures, bypassing the API Gateway's authenticity checks and enabling unauthorized event injection, data manipulation, and potential downstream system compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Wso2 Api Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network vector and no privileges required are accurate; I:H added because payload forgery with valid HMAC is an integrity impact, not merely confidentiality.
Primary rating from Vendor (WSO2).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.
Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Ga
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to ar
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
WSO2 Carbon OAuth, as shipped in WSO2 Identity Server, API Manager, and related WSO2 products, can leave session-bound t
Reflected cross-site scripting (CWE-79) affects WSO2's authentication endpoint, which echoes unsanitized request data in
Exploit-DB