CVE-2026-3416

Name of the Vulnerable Software and Affected Versions API Publisher (affected versions not specified)

Description The API Publisher component used a non-cryptographic pseudorandom number generator (PRNG)—a sequence of numbers that appears random but is determined by a mathematical formula—to create shared secrets for Webhook HMAC validation. Because this PRNG lacks sufficient entropy, a sophisticated attacker could predict future secrets. This allows for the forgery of event payloads with valid HMAC signatures, which bypasses the authenticity verification of the API Gateway, potentially leading to unauthorized event injection, data manipulation, or compromise of downstream systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.