{
  "affected": [
    {
      "affectedData": [
        {
          "product": "etherpad",
          "vendor": "ether",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.6.0, \u003c 3.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad\u0027s src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0."
    }
  ],
  "id": "CVE-2026-55088",
  "lastModified": "2026-08-21T22:16:40.997",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55088",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T21:00:33.315866Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-19T20:17:17.883",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ether/etherpad/pull/7784"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ether/etherpad/security/advisories/GHSA-vqfp-p66c-xrp9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ether/etherpad/tree/3.1.0"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "ep_etherpad-lite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55088"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-294"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-13T14:12:44Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Etherpad\u0027s device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body\n\n## Description\n\nEtherpad ships an endpoint pair under `/tokenTransfer` (`src/node/hooks/express/tokenTransfer.ts`) that lets a logged-in user move their HttpOnly author token to a different browser (typically by scanning a QR code containing the transfer URL). The flow is:\n\n1. **POST `/tokenTransfer`** \u2014 the source device sends a request whose own author cookie is read off the server-side cookie jar. The server mints a random UUID and stores the author token (and arbitrary `prefsHttp` field) under a DB key keyed by that UUID. The UUID is returned.\n2. **GET `/tokenTransfer/{uuid}`** \u2014 the destination device GETs the URL containing the UUID. The server reads the stored record and sets the HttpOnly author cookie on the response.\n\nThe original implementation has three serious flaws:\n\n1. **No expiration check.** `createdAt` is written to the record on POST but never inspected on GET. A leaked transfer URL is redeemable indefinitely.\n2. **No single-use enforcement.** The DB record is not deleted after a successful GET, so the same URL can be redeemed repeatedly \u2014 each redemption yielding a fresh cookie set on whoever issued the GET.\n3. **Author token echoed in the response body.** The GET handler ends with `res.send(tokenData)`, which serializes the full record \u2014 including the raw author token \u2014 into the JSON response. Any JavaScript on the page that issued the GET can read the token, defeating the HttpOnly cookie design that exists specifically to keep the token out of JS reach.\n\nCombined, these mean that any disclosure of a transfer UUID (browser history, mis-shared QR code, screenshot, server log, third-party plugin that proxies the request, an unencrypted intermediate hop) results in **persistent authorship impersonation of the originating account** \u2014 the attacker doesn\u0027t just get one cookie, they can re-redeem and they get the raw token in cleartext for storage / replay against other endpoints.\n\n## Severity rationale\n\n- **AV:N** \u2014 exploitable over the network.\n- **AC:H** \u2014 requires the attacker to learn the transfer UUID via some out-of-band channel; UUIDs are random.\n- **PR:N** \u2014 no authentication required at the redemption endpoint.\n- **UI:R** \u2014 the legitimate user must have issued the POST and the UUID must end up where the attacker can see it (QR code, screenshot, etc.).\n- **C:H / I:H** \u2014 full author identity takeover (read + write everything that author can).\n- **A:N** \u2014 no direct denial-of-service.\n\nCVSS lands at 7.5 (High). Some operators may reasonably score this lower (UI:R + AC:H) if their threat model assumes the transfer URL never leaves the user\u0027s own device pair.\n\n## Affected versions\n\n- `ep_etherpad-lite \u003e= 2.6.0, \u003c= 3.0.0`. The `/tokenTransfer` endpoint pair was added in [`41cb680` \"let user maintain a single session across multiple browsers\" (#7228)](https://github.com/ether/etherpad/commit/41cb680), first tagged in **v2.6.0** (2025-11-18). All three flaws (no TTL, no single-use, token in response body) were present from the introducing commit and persisted through `v3.0.0`.\n\n## Patched versions\n\n- `ep_etherpad-lite \u003e= 3.1.0` \u2014 the fix is on `develop` HEAD as commit `8c6104c`. Update this field with the actual tagged release version when it ships.\n\n## Proof of concept\n\n```\n# 1. Victim posts a transfer from their device.\ncurl -X POST https://pad.example/tokenTransfer \\\n  -H \u0027Cookie: token=t.victim-author-token\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"prefsHttp\": \"\"}\u0027\n# -\u003e {\"id\": \"1f0b2a3c-...\"}\n\n# 2. UUID leaks (browser history, intercepted QR, etc.).\n# 3. Attacker redeems it from a totally different machine:\ncurl -i https://pad.example/tokenTransfer/1f0b2a3c-...\n# Headers include:\n#   Set-Cookie: token=t.victim-author-token; Path=/; HttpOnly; ...\n# Body contains:\n#   {\"token\":\"t.victim-author-token\", \"prefsHttp\": \"\", \"createdAt\": ...}\n#\n# Attacker now owns the victim\u0027s identity. They can also re-redeem the\n# same UUID (no single-use), and the body gives them the cleartext token\n# even if the HttpOnly cookie isn\u0027t useful to their tooling.\n```\n\n## Workarounds\n\n- Disable any UI that surfaces the transfer URL (QR code, copy-button, etc.).\n- Reverse-proxy block `/tokenTransfer/*` if device-pairing is not in use.\n- Set short DB cleanup intervals (does not address the JS-readable body issue).\n\nNone of these workarounds are sufficient on their own \u2014 upgrade is the only complete fix.\n\n## Fix\n\nPatched in [`8c6104c`](https://github.com/ether/etherpad/commit/8c6104c) (PR [#7784](https://github.com/ether/etherpad/pull/7784)):\n\n1. **5-minute TTL** (`TRANSFER_TTL_MS`). Records older than this return 410 Gone. Records with absent/non-numeric `createdAt` (legacy records from older code paths) are treated as expired.\n2. **Single-use.** The DB record is removed **before** the success response is written, so a parallel request that wins the race observes an already-redeemed transfer rather than a second usable copy.\n3. **Body sanitised.** The response body becomes `{ok: true, prefsHttp}` \u2014 the raw author token is no longer included. The HttpOnly cookie set in the same response is the only delivery channel.\n\n```diff\n- const tokenData = await db.get(`${tokenTransferKey}:${id}`);\n+ const key = tokenTransferKey(id);\n+ const tokenData: TokenTransferRequest | undefined = await db.get(key);\n  if (!tokenData) {\n    return res.status(404).send({error: \u0027Token not found\u0027});\n  }\n+ await db.remove(key);\n+ const createdAt = typeof tokenData.createdAt === \u0027number\u0027\n+     ? tokenData.createdAt : 0;\n+ if (Date.now() - createdAt \u003e TRANSFER_TTL_MS) {\n+   return res.status(410).send({error: \u0027Token expired\u0027});\n+ }\n  ...\n- res.send(tokenData);\n+ res.send({ok: true, prefsHttp: tokenData.prefsHttp});\n```\n\n## Resources\n\n- Patched in: https://github.com/ether/etherpad/pull/7784 (squash commit `8c6104c`).\n- Vulnerable code introduced in: https://github.com/ether/etherpad/commit/41cb680 (PR #7228), released in v2.6.0.\n- Background on the HttpOnly author-token migration: ether/etherpad PR #7548 (PR3 of #6701, released in v2.7.3). That earlier PR addressed two adjacent issues (the cookie was previously non-HttpOnly, and the POST handler previously trusted the request body for the token value). This GHSA covers only the three flaws that remained after that earlier patch.\n\n## Credits\n\nReported during an internal security audit by Claude (via @JohnMcLear).",
  "id": "GHSA-vqfp-p66c-xrp9",
  "modified": "2026-08-13T14:12:44Z",
  "published": "2026-08-13T14:12:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ether/etherpad/security/advisories/GHSA-vqfp-p66c-xrp9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ether/etherpad/pull/7784"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ether/etherpad"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token"
}