CVE-2025-27936: Mattermost vulnerable to Observable Timing Discrepancy

April 16, 2025 (updated April 23, 2025)

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.

References

github.com/advisories/GHSA-2j87-p623-8cc2
github.com/mattermost/mattermost
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-27936
pkg.go.dev/vuln/GO-2025-3618

Code Behaviors & Features

Detect and mitigate CVE-2025-27936 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →