Mattermost Server CVE-2025-54499

Exploitation targets the specific code paths that validate Cloud API keys and OAuth client secrets, which compare a submitted value against the stored secret using non-constant-time comparison. The attacker must be able to repeatedly invoke these authentication/validation endpoints and measure response-time differences with enough precision to overcome network and server jitter - this is the primary limiting factor and is reflected in CVSS AC:H. Realistically, success requires a very high volume of requests, low-latency/stable network positioning relative to the server, and no rate-limiting or timing-noise mitigations in front of the endpoint. Only the Cloud API key and OAuth client secret comparisons are affected; this is not a generic authentication bypass, and only Mattermost Server versions 10.5.x <= 10.5.10 and 10.11.x <= 10.11.2 are vulnerable.

This is a genuinely low-priority issue despite the network attack vector. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects the reality: while exploitable remotely without authentication, attack complexity is HIGH (AC:H) because timing-oracle side-channel attacks require thousands of precisely-measured requests to overcome network jitter and statistical noise, and impact is limited to low confidentiality (C:L) with no integrity or availability effect. The EPSS score of 0.27% (18th percentile) independently corroborates low real-world exploitation likelihood, and the vulnerability is NOT listed in CISA KEV. No public exploit code or POC was identified in the provided intelligence. All signals are consistent and point the same direction - there is no conflict between CVSS, EPSS, and KEV status here. This is a defense-in-depth cryptographic hygiene fix (non-constant-time comparison, CWE-208) rather than an urgent, actively-weaponized threat. Patch during normal maintenance cycles.

An unauthenticated remote attacker who already knows or guesses a target Cloud API key or OAuth client secret identifier repeatedly submits candidate secret values and measures the server's response time, using the non-constant-time string comparison as a timing oracle to recover the secret one byte at a time. The attack requires a very large volume of timing-sensitive requests and stable network conditions to statistically distinguish correct from incorrect bytes. No public exploit code was identified at time of analysis.