CVE-2026-70437

The Jenkins Webhook Secret Credentials Provider Plugin version 16.v0cfa_f0215cf5 and earlier is vulnerable to a timing attack. The root cause is the failure to use a constant-time comparison function when validating provided against expected webhook bearer tokens. This discrepancy potentially all...