CVE-2025-54499

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.11.x through 10.11.2

Description The software does not employ constant-time comparison for sensitive string comparisons, creating a timing oracle. This allows attackers to exploit timing differences during response time analysis to perform byte-by-byte brute force attacks on Cloud API keys and OAuth client secrets.

Recommendations Update Mattermost to a version beyond 10.5.10. Update Mattermost to a version beyond 10.11.2.