CVE-2023-46658: Jenkins Msteams Webhook Trigger

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

Affected products

• Jenkins Msteams Webhook Trigger: version 0.1.0 only; version 0.1.1 only

Published 2023-10-25. Last modified 2026-06-17.