CVE-2026-55088: Etherpad Auth Bypass Vulnerability

CVE-2026-55088 Overview

CVE-2026-55088 affects Etherpad, a real-time collaborative editor widely deployed for shared document editing. The vulnerability exists in src/node/hooks/express/tokenTransfer.ts in versions from 2.6.0 up to 3.1.0. The POST /tokenTransfer endpoint stores an author token intended for transfer between browsers, and GET /tokenTransfer/{uuid} returns that record. The stored transfer lacks any expiration check, is not removed after redemption, and the response body includes the raw author token via res.send(tokenData). An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it and impersonate the originating author. Version 3.1.0 fixes the issue.

Critical Impact
Unauthenticated attackers who obtain a transfer UUID can retrieve cleartext author tokens, impersonate authors, and read or write pad content [CWE-200].

Affected Products

Etherpad versions 2.6.0 through 3.0.x
Etherpad tokenTransfer hook in src/node/hooks/express/tokenTransfer.ts
Etherpad deployments exposing /tokenTransfer/{uuid} endpoints

Discovery Timeline

2026-08-19 - CVE-2026-55088 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55088

Vulnerability Analysis

Etherpad implements a token transfer mechanism to move an author identity between browsers. The POST /tokenTransfer route creates a record keyed by a UUID and stores the author's token along with a createdAt timestamp. A subsequent GET /tokenTransfer/{uuid} request returns the record using res.send(tokenData), which includes the raw author token in the response body.

The transfer record has no expiration enforcement despite the presence of createdAt. The record is not deleted after a successful redemption. These two design gaps convert a one-time hand-off into a persistent credential oracle. This is a classic sensitive data exposure issue tracked under [CWE-200].

An attacker who obtains a transfer UUID, whether by observing referrers, log scraping, browser history exposure, or interception during the hand-off, can replay the GET request repeatedly. Each request returns fresh author cookies and the cleartext token, enabling author impersonation for pad read and write operations.

Root Cause

The root cause is missing lifecycle controls on stored transfer records. The handler in src/node/hooks/express/tokenTransfer.ts does not validate createdAt against a maximum age, does not invalidate the record after first read, and returns the entire token payload directly to the client.

Attack Vector

Exploitation requires network access to the Etherpad instance and possession of a valid transfer UUID. The attack does not require authentication. The attacker issues GET /tokenTransfer/{uuid} and parses the returned author token from the JSON body. With the token, the attacker sets the author cookie in a browser session and connects to pads as the impersonated author.

typescript

// Patch reference from Etherpad 3.0.2 hardening (src/node/db/API.ts)
import AttributeMap from '../../static/js/AttributeMap';
import {deserializeOps} from '../../static/js/Changeset';
import ChatMessage from '../../static/js/ChatMessage';
import {Builder} from "../../static/js/Builder";
import {Attribute} from "../../static/js/types/Attribute";

// Mirror of `Pad.SYSTEM_AUTHOR_ID`. Inlined to avoid a circular load
// (API <-> Pad) at module init time.
const SYSTEM_AUTHOR_ID = 'a.etherpad-system';

Source: GitHub Commit 8c6104c

Detection Methods for CVE-2026-55088

Indicators of Compromise

Repeated GET /tokenTransfer/{uuid} requests against the same UUID from one or more source addresses.
Access log entries where the same transfer UUID is redeemed after any successful redemption should already have consumed it.
Author sessions originating from unexpected IP addresses or user agents shortly after a tokenTransfer request.

Detection Strategies

Inspect Etherpad HTTP access logs for /tokenTransfer/ paths and correlate UUIDs against redemption counts.
Alert when a single transfer UUID is fetched more than once, or when redemptions occur outside a short expected window after creation.
Correlate author cookie usage with the source of the originating tokenTransfer request to identify session divergence.

Monitoring Recommendations

Forward Etherpad reverse proxy logs to a centralized log platform and retain the full request path and status code.
Baseline normal tokenTransfer volumes and alert on deviations, especially spikes in GET traffic to that route.
Monitor for pad edits attributed to authors whose recent activity does not match historical patterns.

How to Mitigate CVE-2026-55088

Immediate Actions Required

Upgrade Etherpad to version 3.1.0 or later, which contains the fix for this vulnerability.
Rotate any author identifiers on affected instances if there is evidence of tokenTransfer abuse.
Restrict network exposure of Etherpad endpoints to trusted networks until patching is complete.

Patch Information

The fix is included in Etherpad 3.1.0. Review the GitHub Security Advisory GHSA-vqfp-p66c-xrp9, the GitHub Pull Request 7784, and the Etherpad 3.1.0 source tree. The remediation commit is documented in GitHub Commit 8c6104c.

Workarounds

Block or rate-limit /tokenTransfer/ routes at the reverse proxy until the upgrade is applied.
Require authenticated access to the Etherpad instance through an upstream authenticating proxy.
Disable browser-to-browser author transfer features in deployments that do not require them.

bash

# Example nginx block to restrict tokenTransfer redemption to internal networks
location ~ ^/tokenTransfer/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://etherpad_upstream;
}