CVE-2025-54499: Mattermost has an Observable Timing Discrepancy vulnerability

The analysis of the provided patches indicates that the vulnerability lies in the IsValidWebAuthRedirectURL function. This function was using a non-constant-time string comparison (strings.Index), which could be exploited in a timing attack. The patch replaces this with a safer comparison of URL components.

It is important to note that there is a discrepancy between the vulnerability description, which mentions 'Cloud API keys and OAuth client secrets,' and the actual code change in the provided commits, which is related to OAuth redirect URL validation and the siteURL. The identified vulnerable function does not directly handle API keys or client secrets. However, the core of the vulnerability - the lack of constant-time comparison - is present and was fixed in the analyzed commits. The confidence is rated as 'medium' due to this discrepancy.