The vulnerability lies in the use of a non‑cryptographic pseudorandom number generator to create HMAC secrets for webhook validation in the API Publisher component. Because the generator lacks sufficient entropy, an attacker can predict the secrets that will be used for upcoming webhooks. Using the predicted secret, the attacker can calculate valid HMAC signatures and craft event payloads that the API Gateway will accept as authentic. This effectively allows the attacker to bypass the gateway’s authenticity checks, inject arbitrary events, modify data that is processed downstream, or even compromise downstream systems that trust these events. The weakness corresponds to CWE‑330: Use of Insufficiently Random Number Generator.

The affected products are WSO2 API Control Plane and WSO2 API Manager, as identified by the CNA. Version information was not made explicit in the advisory, so any release that includes the legacy PRNG implementation before the patch should be considered vulnerable.

The CVSS score of 5.9 indicates moderate severity. No EPSS score is reported. The vulnerability is not listed in the CISA Key Exploited Vulnerabilities catalog. The likely attack vector is remote, through the exposed webhook endpoint, as the attacker can predict the secret from a remote location and forge signed payloads that will be accepted by the gateway. The conditions for exploitation are straightforward: the webhook endpoint is enabled and the attacker can send forged event payloads. The exploit would allow unauthorized event injection, which could lead to data manipulation or downstream compromise.