Timing side-channel in Jenkins Webhook Secret Credentials Provider Plugin (CVE-2026-70437)

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when validating webhook bearer tokens against expected values. This timing discrepancy allows attackers to apply statistical analysis methods to iteratively recover a valid webhook bearer token without direct access to the credential store. Affected versions: - 16.v0cfa_f0215cf5 and earlier We recommend updating to: 32.v09c9b_522f0a_8. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/438 Details: https://vuln.today/cve/CVE-2026-70437