The Jenkins Webhook Secret Credentials Provider Plugin up to version 16.v0cfa_f0215cf5 contains a timing side-channel vulnerability because it does not perform constant-time comparison of the provided webhook bearer token against the expected token. This flaw could enable an attacker to use statistical timing analysis to gradually discover a valid bearer token, potentially allowing unauthorized webhook interactions. No CVSS score or vendor remediation details are currently available.

An attacker could leverage timing differences in token comparison to recover a valid webhook bearer token. This could lead to unauthorized triggering of webhook actions or other interactions that rely on bearer token authentication. There is no indication of active exploitation or broader impact beyond token disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting webhook access through network controls or additional authentication layers to reduce risk.