Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-27936

Webhook Secret Exposure via Timing attack in MSteams plugin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 10.5.0 to ≤ 10.5.1affected
  • 10.6.0unaffected
  • 10.5.2unaffected

References