CVE-2026-70437: Observable Timing Discrepancy

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

PT-2026-68272

Name of the Vulnerable Software and Affected Versions Jenkins Webhook Secret Credentials Provider Plugin versions prior to 16.v0cfa f0215cf5 Description The plugin fails to use a constant-time comparison function when verifying if the provided webhook bearer token matches the expected one. This...