CVE-2026-55088

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55088
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55088.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55088
Aliases
Published
2026-08-19T19:30:20Z
Modified
2026-09-11T03:30:50Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
Details

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-294"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55088.json"
}
References

Affected packages

Git / github.com/ether/etherpad

Affected ranges

Type
GIT
Repo
https://github.com/ether/etherpad
Events
Introduced
e1161e5eecc014784ecce8889273038537d05dbe
Fixed
8c6104c5d5daf41f0d454acc04d42dffa0e0d996
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.6.0"
        },
        {
            "fixed": "3.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55088.json"