CVE-2025-27936

Summary

CVE-2025-27936 is a timing attack vulnerability affecting Mattermost Plugin MSTeams versions below 2.1.0 and Mattermost Server versions 10.5.x up to 10.5.1. The issue lies in the constant time comparison failure of MSTeams plugin webhook secrets in these versions. An attacker can exploit this vulnerability by triggering webhook events to retrieve the webhook secret through timing differences during the comparison process. This could potentially lead to unauthorized access and manipulation of the affected Mattermost instance's MS Teams plugin features.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.