MEDIUM 6.8 GitHub
CVE-2026-55088
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body
## Description
Etherpad ships an endpoint pair under `/tokenTransfer` (`src/node/hooks/express/tokenTransfer.ts`) that lets a logged-in user move their HttpOnly author token to a different browser (typically by scanning a QR code containing the transfer URL). The flow is:
1. **POST `/tokenTransfer`** — the source device sends a request whose
Affected Products
- npm/ep_etherpad-lite >= 2.6.0, <= 3.0.0
References
- https://github.com/advisories/GHSA-vqfp-p66c-xrp9
- https://github.com/ether/etherpad/security/advisories/GHSA-vqfp-p66c-xrp9
- https://github.com/ether/etherpad/pull/7784
- https://github.com/advisories/GHSA-vqfp-p66c-xrp9
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-08-13 via GitHub. Affected: npm/ep_etherpad-lite >= 2.6.0, <= 3.0.0.
vulnfeed aggregates 10617 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.