CVE-2026-55088

Received Received - Intake

Etherpad Author Token Transfer Session Exposure

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-55088

EUVD

EUVD-2026-62725

Affected Vendors & Products

Vendor	Product	Version / Range
etherpad	etherpad	From 2.6.0 (inc) to 3.1.0 (inc)
ether	ep_etherpad_lite	From 2.6.0 (inc) to 3.0.0 (inc)
ether	etherpad	3.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This vulnerability affects Etherpad versions 2.6.0 to 3.0.0. It involves an unauthenticated endpoint POST /tokenTransfer that stores and exposes author tokens via GET /tokenTransfer/{uuid}. The tokens lack expiration checks, are not deleted after use, and are sent in cleartext. Attackers can reuse leaked transfer UUIDs to impersonate users indefinitely.

Detection Guidance

Check for suspicious GET requests to /tokenTransfer/{uuid} endpoints or POST requests to /tokenTransfer that return cleartext author tokens. Review server logs for repeated access to these endpoints or unusual activity patterns.

Impact Analysis

An attacker who obtains a transfer UUID can repeatedly redeem it to receive fresh author cookies and the raw author token. This allows them to impersonate the original user, gaining full read and write access to the victim's Etherpad documents without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive documents, potentially violating data confidentiality requirements in GDPR and HIPAA. Uncontrolled token exposure may result in data breaches, requiring breach notifications and compliance penalties.

Mitigation Strategies

Upgrade Etherpad to version 3.1.0 or later immediately. If upgrading is not possible, block access to the /tokenTransfer endpoints at the network level and disable any transfer URL exposure features.

Hi! I’m here to help you understand CVE-2026-55088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70