CVE-2025-54499: Insecure string comparison enables timing attacks

Published Oct 16, 2025
·
Updated

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets

Affected Software

6 affected componentsFixes available
Mattermost Mattermost<=10.5.10, <=10.11.2
go/github.com/mattermost/mattermost-server>=10.11.0<10.11.3
10.11.3
go/github.com/mattermost/mattermost-server>=10.5.0<10.5.11
10.5.11
go/github.com/mattermost/mattermost/server/v8<8.0.0-20250728063359-38208b8f065f
8.0.0-20250728063359-38208b8f065f
Mattermost Mattermost Server>=10.5.0<10.5.11
Mattermost Mattermost Server>=10.11.0<10.11.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/github.com/mattermost/mattermost-server to a version that resolves this vulnerability.

    Fixed in 10.11.3
  2. Upgrade

    Upgrade go/github.com/mattermost/mattermost-server to a version that resolves this vulnerability.

    Fixed in 10.5.11
  3. Upgrade

    Upgrade go/github.com/mattermost/mattermost/server/v8 to a version that resolves this vulnerability.

    Fixed in 8.0.0-20250728063359-38208b8f065f
  4. Upgrade

    Upgrade Mattermost to a version that resolves this vulnerability.

    Fixed in 10.12.0
  5. Upgrade

    Upgrade Mattermost to a version that resolves this vulnerability.

    Fixed in 10.5.11
  6. Upgrade

    Upgrade Mattermost to a version that resolves this vulnerability.

    Fixed in 10.11.3

Event History

Oct 16, 2025
CVE Published
via MITRE·08:17 AM
Data Sourced
via MITRE·08:17 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:30 AM
Data Sourced
via GitHub·09:30 AM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-54499?

CVE-2025-54499 is classified as a high severity vulnerability due to its potential to allow attackers to exploit timing oracles for brute force attacks.

2

How do I fix CVE-2025-54499?

To mitigate CVE-2025-54499, it is recommended to upgrade Mattermost to versions above 10.5.10 and 10.11.2 where the constant-time comparison issue has been addressed.

3

What versions of Mattermost are affected by CVE-2025-54499?

CVE-2025-54499 affects Mattermost versions 10.5.x up to 10.5.10 and 10.11.x up to 10.11.2.

4

What type of attack does CVE-2025-54499 enable?

CVE-2025-54499 enables attackers to perform byte-by-byte brute force attacks through response time analysis on sensitive strings such as Cloud API keys.

5

What products are impacted by CVE-2025-54499?

The impacted product is Mattermost, specifically the versions stated in the vulnerability details.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203