AIKIDO-2025-10328

TL;DR

Affected versions of this package use a simple string comparison instead of a constant-time comparison in the Slack::Event::Request#verify! method, leaving it vulnerable to timing attacks. This method is used for verifying incoming HTTP requests from Slack. An attacker could exploit this by carefully measuring the response time of signature verification attempts, allowing them to incrementally guess the correct signature and bypass security validations.