Timing Oracle Vulnerability in Mattermost Cloud API and OAuth Client Secrets

CVE-2025-54499

What is CVE-2025-54499?

Mattermost versions 10.5.x (up to 10.5.10) and 10.11.x (up to 10.11.2) are vulnerable due to the failure to utilize constant-time comparison for sensitive string checks. This oversight allows adversaries to exploit timing differences between responses, leading to potential byte-by-byte brute force attacks. By analyzing response times, attackers can compromise sensitive information such as Cloud API keys and OAuth client secrets, posing a significant risk to the security of applications utilizing Mattermost.

References