The plugin performs a normal string comparison when validating the webhook bearer token, rather than using a constant‑time comparison. This flaw, a CWE‑208 timing side‑channel vulnerability, permits an attacker to perform a timing analysis and statistically infer the token. If obtained, the attacker would gain the ability to spoof privileged webhooks and trigger arbitrary actions within the Jenkins instance, effectively compromising the confidentiality of the Jenkins deployment.

The Jenkins Webhook Secret Credentials Provider Plugin, version 16.v0cfa_f0215cf5 and earlier, is affected. This applies to installations of the Jenkins Project that use that plugin or any earlier release before the fixed version was made available.

The CVE has a CVSS score of 3.7 and an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. In the absence of a known public exploit, the risk is primarily due to the potential for an attacker to discover the bearer token by leveraging the timing side‑channel. Successful exploitation requires the attacker to be able to send repeated authentication attempts to the webhook endpoint, which may be restricted by network security controls. The severity therefore depends on the exposure of the endpoint and the protective measures in place, but the vulnerability is capable of delivering a critical data breach if the endpoint is reachable from untrusted networks.