Is CVE-2026-55088 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55088 being exploited in the wild.

How severe is CVE-2026-55088?

Medium severity, with a CVSS score of 6.8, published 13 August 2026.

Which products and versions are affected?

Etherpad Lite >= 2.6.0, = 2.6.0, <= 3.0.0, SEMVER:introduced=2.6.0,fixed=3.1.0.

Is there a fix for CVE-2026-55088?

Yes. ep_etherpad-lite (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55088 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55088?

Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55088: Etherpad replayable token-transfer endpoint with cleartext token exposure

Q: Is there a fix for CVE-2026-55088?

Yes. ep_etherpad-lite (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55088 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55088?

Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55088 · Severity: medium · CVSS 6.8 · Published 2026-08-13

Etherpad's device-to-device token-transfer feature—which allows users to move their authentication session to a different browser via QR code—has three critical flaws: transfer URLs never expire, can be redeemed repeatedly, and expose the raw authentication token in plaintext. If a transfer URL leaks (via browser history, screenshot, or interception), an attacker can permanently impersonate the victim's account indefinitely, extracting the token for offline replay.

Technologies: ep_etherpad-lite (npm). Vendors: npm.

Quick answers

Is CVE-2026-55088 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55088 being exploited in the wild.
How severe is CVE-2026-55088?: Medium severity, with a CVSS score of 6.8, published 13 August 2026.
Which products and versions are affected?: Etherpad Lite >= 2.6.0, <= 3.0.0; ep_etherpad-lite (npm) >= 2.6.0, <= 3.0.0, SEMVER:introduced=2.6.0,fixed=3.1.0.
Is there a fix for CVE-2026-55088?: Yes. ep_etherpad-lite (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55088 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55088?: Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ep_etherpad-lite (npm): upgrade to 3.1.0 or later
```
npm install ep_etherpad-lite@3.1.0
```

Technical details

The vulnerability resides in the `/tokenTransfer` endpoint pair (POST to mint a transfer UUID, GET to redeem it). Three distinct flaws compound the risk: (1) missing expiration check—the `createdAt` timestamp is stored but never validated, allowing indefinite replay; (2) lack of single-use enforcement—the DB record persists after redemption, enabling multiple cookie extractions from one UUID; (3) token leakage in response body—the GET handler returns the full record as JSON, including the raw author token, defeating the HttpOnly cookie design. The endpoint requires no authentication to redeem, only possession of the UUID. Combined, these allow an attacker who obtains a leaked transfer URL (through browser history, QR code screenshots, server logs, or proxy interception) to achieve persistent account takeover with cleartext token extraction. The fix, shipped in v3.1.0, implements a 5-minute TTL, deletes the record before responding, and sanitizes the response body to exclude the token.

Affected products

Ether ep_etherpad-lite >= 2.6.0, <= 3.0.0

Identifiers

CVE-2026-55088
GHSA-vqfp-p66c-xrp9

Timeline

2026-06-10: disclosed: Advisory published to GitHub Advisory Database
2026-08-13: patched: Patched in v3.1.0 via commit 8c6104c
2026-08-13: advisory: CVE-2026-55088 assigned; GHSA-vqfp-p66c-xrp9 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.