The Jenkins Webhook Secret Credentials Provider Plugin up to version 16.v0cfa_f0215cf5 performs token comparison without using a constant-time function. This flaw enables attackers to exploit timing differences during token verification to gradually discover valid webhook bearer tokens. The vulnerability is identified as CWE-208 (Information Exposure Through Timing Discrepancy). No official remediation or patch information is currently available, and no known exploits are reported in the wild.

An attacker could potentially obtain a valid webhook bearer token by measuring response times during token verification. This could allow unauthorized triggering of webhook actions that rely on the bearer token for authentication. The impact is limited to confidentiality (information disclosure) with no direct effect on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to webhook endpoints and monitoring for unusual webhook activity. Avoid relying solely on this plugin for critical authentication without additional safeguards.