{"id":"CVE-2025-27936","aliases":["GHSA-2j87-p623-8cc2","GO-2025-3618"],"title":"Mattermost vulnerable to Observable Timing Discrepancy","summary":"Mattermost vulnerable to Observable Timing Discrepancy","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"mattermost","product":"github.com/mattermost/mattermost/server/v8","ecosystem":"go","affected":["github.com/mattermost/mattermost/server/v8 >= 10.5.0, < 10.5.2","github.com/mattermost/mattermost/server/v8 < 8.0.0-20250314142426-c049748b8863","github.com/mattermost/mattermost-plugin-msteams < 2.1.0"],"patched":["github.com/mattermost/mattermost/server/v8 10.5.2","github.com/mattermost/mattermost/server/v8 8.0.0-20250314142426-c049748b8863","github.com/mattermost/mattermost-plugin-msteams 2.1.0"],"published":"2025-04-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:56.933832550Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2j87-p623-8cc2","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27936"},{"url":"https://github.com/mattermost/mattermost"},{"url":"https://mattermost.com/security-updates"},{"url":"https://pkg.go.dev/vuln/GO-2025-3618"}],"tags":["osv","go"],"epss":0.00339,"epssPercentile":0.27475,"ingestedAt":"2026-09-12T03:13:01.745Z","slug":"CVE-2025-27936","body":"## Overview\n\nMattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.\n\n## Affected packages\n\n- `github.com/mattermost/mattermost/server/v8 >= 10.5.0, < 10.5.2`\n- `github.com/mattermost/mattermost/server/v8 < 8.0.0-20250314142426-c049748b8863`\n- `github.com/mattermost/mattermost-plugin-msteams < 2.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/mattermost/mattermost/server/v8 10.5.2`\n- `github.com/mattermost/mattermost/server/v8 8.0.0-20250314142426-c049748b8863`\n- `github.com/mattermost/mattermost-plugin-msteams 2.1.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}