Signature verification bypass via observable timing discrepancy

Timing discrepancy in signature checks in Adobe Magento Open Source 2.3.4 and earlier allows remote authenticated users to bypass verification. Adobe has not disclosed the affected signature-checking locus or which comparison leaks timing differences from attacker-controlled signatures. Administrative access is required, and the resulting bypass can defeat signature verification; Adobe has not bounded the subsequent action.