Executive brief
Etherpad's device-to-device token-transfer feature—which allows users to move their authentication session to a different browser via QR code—has three critical flaws: transfer URLs never expire, can be redeemed repeatedly, and expose the raw authentication token in plaintext. If a transfer URL leaks (via browser history, screenshot, or interception), an attacker can permanently impersonate the victim's account indefinitely, extracting the token for offline replay.
Technical details
The vulnerability resides in the `/tokenTransfer` endpoint pair (POST to mint a transfer UUID, GET to redeem it). Three distinct flaws compound the risk: (1) missing expiration check—the `createdAt` timestamp is stored but never validated, allowing indefinite replay; (2) lack of single-use enforcement—the DB record persists after redemption, enabling multiple cookie extractions from one UUID; (3) token leakage in response body—the GET handler returns the full record as JSON, including the raw author token, defeating the HttpOnly cookie design. The endpoint requires no authentication to redeem, only possession of the UUID. Combined, these allow an attacker who obtains a leaked transfer URL (through browser history, QR code screenshots, server logs, or proxy interception) to achieve persistent account takeover with cleartext token extraction. The fix, shipped in v3.1.0, implements a 5-minute TTL, deletes the record before responding, and sanitizes the response body to exclude the token.
Affected products
- Ether ep_etherpad-lite >= 2.6.0, <= 3.0.0
Timeline
- 2026-06-10: disclosed: Advisory published to GitHub Advisory Database
- 2026-08-13: patched: Patched in v3.1.0 via commit 8c6104c
- 2026-08-13: advisory: CVE-2026-55088 assigned; GHSA-vqfp-p66c-xrp9 published