Executive brief
Etherpad is a real-time collaborative text editor used in numerous organizations for shared document editing. This advisory addresses six security hardening improvements including weak random number generation for session tokens, login timing vulnerabilities, and API parameter pollution. While individually moderate-severity issues, these fixes collectively reduce attack surface and improve the platform's resilience against token prediction, credential attacks, and unauthorized API manipulation.
Technical details
The advisory covers six distinct vulnerability classes: (1) weak RNG for session/author/readonly tokens using Math.random() instead of cryptographic randomness (CWE-330), (2) non-constant-time password comparison in OIDC login without failure delay (CWE-208/307), (3) insufficient validation of plugin dependency paths from package.json allowing path traversal (CWE-22), (4) API parameter pollution via header merging into /api/2 field set (CWE-235), (5) unintended pad creation via API.appendChatMessage (missing getPadSafe), and (6) error message information disclosure in admin file server (CWE-209). All are admin-gated or require prior authentication except token generation. Patches are included in version 3.3.0 released in June 2026.
Affected products
- Etherpad Etherpad <= 3.2.0
Timeline
- 2026-08-17: disclosed
- 2026-06-10: patched: PR #7906 merged; fix available in version 3.3.0