Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-55088Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Medium 6.8

In plain English

A medium-severity information exposure in etherpad from ether. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	ep_etherpad-lite	3.1.0	GHSA-vqfp-p66c-xrp9

Affected products (as reported)

Vendor	Product	Versions
ether	etherpad	>= 2.6.0, < 3.1.0

Weakness: CWE-200, CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/ether/etherpad/security/advisories/GHSA-vqfp-p66c-xrp9 x_refsource_CONFIRM
https://github.com/ether/etherpad/pull/7784 x_refsource_MISC
https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996 x_refsource_MISC
https://github.com/ether/etherpad/tree/3.1.0 x_refsource_MISC