---
id: CVE-2025-27936
aliases:
  - GHSA-2j87-p623-8cc2
  - GO-2025-3618
title: Mattermost vulnerable to Observable Timing Discrepancy
summary: Mattermost vulnerable to Observable Timing Discrepancy
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: mattermost
product: github.com/mattermost/mattermost/server/v8
ecosystem: go
affected:
  - 'github.com/mattermost/mattermost/server/v8 >= 10.5.0, < 10.5.2'
  - >-
    github.com/mattermost/mattermost/server/v8 <
    8.0.0-20250314142426-c049748b8863
  - github.com/mattermost/mattermost-plugin-msteams < 2.1.0
patched:
  - github.com/mattermost/mattermost/server/v8 10.5.2
  - github.com/mattermost/mattermost/server/v8 8.0.0-20250314142426-c049748b8863
  - github.com/mattermost/mattermost-plugin-msteams 2.1.0
published: '2025-04-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:56.933832550Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2j87-p623-8cc2'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-27936'
  - url: 'https://github.com/mattermost/mattermost'
  - url: 'https://mattermost.com/security-updates'
  - url: 'https://pkg.go.dev/vuln/GO-2025-3618'
tags:
  - osv
  - go
epss: 0.00339
epssPercentile: 0.24647
ingestedAt: '2026-09-12T03:13:01.745Z'
---

## Overview

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.

## Affected packages

- `github.com/mattermost/mattermost/server/v8 >= 10.5.0, < 10.5.2`
- `github.com/mattermost/mattermost/server/v8 < 8.0.0-20250314142426-c049748b8863`
- `github.com/mattermost/mattermost-plugin-msteams < 2.1.0`

## Remediation

Upgrade to a patched release:

- `github.com/mattermost/mattermost/server/v8 10.5.2`
- `github.com/mattermost/mattermost/server/v8 8.0.0-20250314142426-c049748b8863`
- `github.com/mattermost/mattermost-plugin-msteams 2.1.0`