CVE-2022-39308

CVE-2022-39308 is a timing attack vulnerability affecting GoCD versions 19.2.0 to 19.10.0, stemming from the use of regular string comparison for access token validation. This flaw allows attackers to potentially brute-force API access tokens by observing timing differences during validation. Rated Medium severity (CVSS 5.9), it has a network attack vector and high confidentiality impact, but requires high attack complexity. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.